Analysis
-
max time kernel
51s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 21:06
General
-
Target
SecuriteInfo.com.Generic.mg.f90bda9159b6e075.32191.dll
-
Size
848KB
-
MD5
f90bda9159b6e075694065583ad97613
-
SHA1
ae374b728c6906ce3648b8d86393d48daa0876a4
-
SHA256
40e39b3c88888e1ed60908e5e5797ba3566273a9c7cc0e09b39fb615b5ff4b4d
-
SHA512
70c130a9aa24c04ae81370b1f1f50cd7e3167721fc66b1d528bca524108ccc35508a2ac2e14a5f52d4a35ee16be4293f854fc4cbcb37c568e8d3f169fe2094df
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 3 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.f90bda9159b6e075.32191.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.f90bda9159b6e075.32191.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-2-0x0000000000000000-mapping.dmp
-
memory/2360-3-0x00000000734C0000-0x00000000734FD000-memory.dmpFilesize
244KB
-
memory/2360-4-0x00000000734C0000-0x00000000734FD000-memory.dmpFilesize
244KB
-
memory/2360-5-0x00000000030A0000-0x00000000030A1000-memory.dmpFilesize
4KB
-
memory/2360-6-0x00000000734C0000-0x00000000734FD000-memory.dmpFilesize
244KB