Analysis
- max time kernel
34s - max time network
91s - platform
windows7_x64 - resource
win7v20201028 - submitted
24/02/2021, 15:06
General
- Target a0225dabdd8d4d5c703fda4e422da2e2ee7632671bd6a66855232c26c6f2325a.dll
- Size 188KB
- Sample210224-fa2nrff6c2
- SHA256 a0225dabdd8d4d5c703fda4e422da2e2ee7632671bd6a66855232c26c6f2325a
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
111
C2
-
209.151.236.42:443
-
91.121.94.86:8172
-
5.189.144.136:6516
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Blocklisted process makes network request 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0225dabdd8d4d5c703fda4e422da2e2ee7632671bd6a66855232c26c6f2325a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0225dabdd8d4d5c703fda4e422da2e2ee7632671bd6a66855232c26c6f2325a.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1692-8-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
memory/2024-3-0x00000000766F1000-0x00000000766F3000-memory.dmp
memory/2024-4-0x0000000074AF0000-0x0000000074C93000-memory.dmp
memory/2024-5-0x0000000074E60000-0x0000000074E91000-memory.dmp
memory/2024-6-0x0000000000330000-0x0000000000336000-memory.dmp
memory/2024-7-0x0000000074E60000-0x0000000074E7F000-memory.dmp