Analysis
- max time kernel
32s - max time network
89s - platform
windows7_x64 - resource
win7v20201028 - submitted
24/02/2021, 15:09
General
- Target 55ba4fd13d72f62d19c69be0026b3d62882f067611c6fdf609b0fa723c8cb1ed.dll
- Size 188KB
- Sample210224-a76w184792
- SHA256 55ba4fd13d72f62d19c69be0026b3d62882f067611c6fdf609b0fa723c8cb1ed
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
111
C2
-
209.151.236.42:443
-
91.121.94.86:8172
-
5.189.144.136:6516
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Blocklisted process makes network request 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba4fd13d72f62d19c69be0026b3d62882f067611c6fdf609b0fa723c8cb1ed.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba4fd13d72f62d19c69be0026b3d62882f067611c6fdf609b0fa723c8cb1ed.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-8-0x000007FEF5AE0000-0x000007FEF5D5A000-memory.dmp
memory/2024-3-0x00000000750C1000-0x00000000750C3000-memory.dmp
memory/2024-4-0x0000000074050000-0x00000000741F3000-memory.dmp
memory/2024-5-0x00000000743C0000-0x00000000743F1000-memory.dmp
memory/2024-6-0x0000000000150000-0x0000000000156000-memory.dmp
memory/2024-7-0x00000000743C0000-0x00000000743DF000-memory.dmp