Analysis
-
max time kernel
46s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-01-2021 02:09
General
-
Target
SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll
-
Size
848KB
-
MD5
44c2ffce6b6d0000fa0b64b135f15485
-
SHA1
855bbfb32f1eb41d30fad867eba8e80df15993b7
-
SHA256
a25178f738fcc04b6247d4008da0c4fce014fce565d09bf8ae9735427e812904
-
SHA512
56261cbc7936bf0e55acccc725f303d3db4527d1f6137f3aa957a4c02a1b13dd261c7e5a0003aae58df5745589366b52ca3c51817b43477098559244aa1d7fb4
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 3 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-2-0x0000000000000000-mapping.dmp
-
memory/1872-3-0x0000000073850000-0x000000007388D000-memory.dmpFilesize
244KB
-
memory/1872-4-0x0000000073850000-0x000000007388D000-memory.dmpFilesize
244KB
-
memory/1872-5-0x0000000002F40000-0x0000000002F41000-memory.dmpFilesize
4KB
-
memory/1872-6-0x0000000073850000-0x000000007388D000-memory.dmpFilesize
244KB