dridex | a5fddc91457c8a5274dcb6bf1e366d9fedd35cb234083d42108c6ed4575db5b4

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
24/02/2021, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5fddc91457c8a5274dcb6bf1e366d9fedd35cb234083d42108c6ed4575db5b4.dll
Size 188KB
Sample210224-9cc8lmn682
SHA256 a5fddc91457c8a5274dcb6bf1e366d9fedd35cb234083d42108c6ed4575db5b4
MD5 7e206a35f6972ce63fd8d57256858663
SHA1 f2704bc3d9be265ccc66122ff254bca729c55f04
SHA512 f6a51825203cc3814028731b087509479ab8282d95822a9ce240ebac50f37374375ee8f7e77fa88bc657283f2961c5da03e528fc5c7c9078740cc91d3efd2a4a
MD5 SHA1 SHA512

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1820-5-0x0000000074680000-0x00000000746B1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1820	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1524	WerFault.exe
1524	WerFault.exe
1524	WerFault.exe
1524	WerFault.exe
1524	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 532 wrote to memory of 1820	532	rundll32.exe	25
PID 1820 wrote to memory of 1524	1820	rundll32.exe	30
PID 1820 wrote to memory of 1524	1820	rundll32.exe	30
PID 1820 wrote to memory of 1524	1820	rundll32.exe	30
PID 1820 wrote to memory of 1524	1820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5fddc91457c8a5274dcb6bf1e366d9fedd35cb234083d42108c6ed4575db5b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5fddc91457c8a5274dcb6bf1e366d9fedd35cb234083d42108c6ed4575db5b4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 352
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-8-0x0000000001DA0000-0x0000000001DB1000-memory.dmp

Download

memory/1524-9-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1820-3-0x0000000075C61000-0x0000000075C63000-memory.dmp

Download

memory/1820-4-0x0000000074310000-0x00000000744B3000-memory.dmp

Download

memory/1820-5-0x0000000074680000-0x00000000746B1000-memory.dmp

Download

memory/1820-6-0x00000000001A0000-0x00000000001A6000-memory.dmp

Download