dridex | 94398cc7a24bca7f915266076c6d2beba0a4e8aa7501c654395b5a4b7f18d0c5

Analysis

max time kernel
30s
max time network
86s
platform
windows7_x64
resource
win7v20201028
submitted
27/01/2021, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Generic.mg.23c0fb4c9e554957.9965.dll
Size 499KB
Sample210127-75ba23tr5e
SHA256 94398cc7a24bca7f915266076c6d2beba0a4e8aa7501c654395b5a4b7f18d0c5
MD5 23c0fb4c9e554957c9f552e5c3802201
SHA1 c95b6507d8cbb8aeb2dedabeb388e4993e87508c
SHA512 61a40fd8dfe54587b7478c8adc91d2c430ad1470bd12aa9249256ea794f0929970be40b734449704ba8ebdd0679cd9bcad198f21c6732196be33f4684b00b51a
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

193.90.12.20:443
185.181.9.76:5037
175.207.13.56:5353
212.129.24.84:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1948-5-0x0000000074F80000-0x0000000074FBD000-memory.dmp	dridex_ldr
behavioral1/memory/1948-6-0x0000000074F80000-0x0000000074FBD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26
PID 792 wrote to memory of 1948	792	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.23c0fb4c9e554957.9965.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.23c0fb4c9e554957.9965.dll
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-2-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Download

memory/1288-8-0x000007FEF7F80000-0x000007FEF81FA000-memory.dmp

Download

memory/1948-4-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/1948-5-0x0000000074F80000-0x0000000074FBD000-memory.dmp

Download

memory/1948-6-0x0000000074F80000-0x0000000074FBD000-memory.dmp

Download

memory/1948-7-0x0000000000150000-0x0000000000151000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads