Analysis
-
max time kernel
53s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 23:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Dridex.735.1019.2829.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Trojan.Dridex.735.1019.2829.dll
-
Size
848KB
-
MD5
cb739888f483ab48dad3c910d16358ad
-
SHA1
4ab4b3b4fda63cc5ddee5b0cbb5f4abdf3afc855
-
SHA256
71f29382dbfa7d636dcf5e1fc86bf628623dcf5d30fb08063e2594037dc7d9ff
-
SHA512
771ca694786e731378e4c3e565f8ad80c3f8eb695499d279bcc435a0216e9fd1a2a2a080a25a2c0a4fb68fe1ed1861f071b0860d2d135c9d0c9dcafa5b12f20d
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1676-3-0x00000000743A0000-0x00000000743DD000-memory.dmp dridex_ldr behavioral2/memory/1676-4-0x00000000743A0000-0x00000000743DD000-memory.dmp dridex_ldr behavioral2/memory/1676-6-0x00000000743A0000-0x00000000743DD000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 860 wrote to memory of 1676 860 regsvr32.exe regsvr32.exe PID 860 wrote to memory of 1676 860 regsvr32.exe regsvr32.exe PID 860 wrote to memory of 1676 860 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.1019.2829.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.1019.2829.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1676-2-0x0000000000000000-mapping.dmp
-
memory/1676-3-0x00000000743A0000-0x00000000743DD000-memory.dmpFilesize
244KB
-
memory/1676-4-0x00000000743A0000-0x00000000743DD000-memory.dmpFilesize
244KB
-
memory/1676-5-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/1676-6-0x00000000743A0000-0x00000000743DD000-memory.dmpFilesize
244KB