dridex | e49a7c26f476a2556574d3b2194e4547be9657d62b37005d272d370039569394

Analysis

max time kernel
39s
max time network
64s
platform
windows10_x64
resource
win10v20201028
submitted
21-01-2021 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca792b4004c1b91548df22769b235fb.dll
Size

236KB
MD5

bca792b4004c1b91548df22769b235fb
SHA1

c5f3a8fe1860b0ea23bd4589a0d4ca10efe7da4b
SHA256

e49a7c26f476a2556574d3b2194e4547be9657d62b37005d272d370039569394
SHA512

a485e78c9426f95876316014cb04829567de6da25af5478c4420f40d6586cf35318acef39f43aa01df25f7c647cd014627ee23c1a397df02e3140377f5c2c0d2

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/2444-3-0x00000000739B0000-0x00000000739ED000-memory.dmp	dridex_ldr
behavioral2/memory/2444-5-0x00000000739B0000-0x00000000739CF000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1456 wrote to memory of 2444	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2444	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2444	1456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca792b4004c1b91548df22769b235fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca792b4004c1b91548df22769b235fb.dll,#1
2⤵
PID:2444

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-2-0x0000000000000000-mapping.dmp

Download
memory/2444-3-0x00000000739B0000-0x00000000739ED000-memory.dmp

Filesize
244KB

Download
memory/2444-4-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2444-5-0x00000000739B0000-0x00000000739CF000-memory.dmp

Filesize
124KB

Download