General

  • Target

    57e910e74454ad625ab7b12954572263.dll

  • Size

    196KB

  • Sample

    210304-98tcvb3vzn

  • MD5

    57e910e74454ad625ab7b12954572263

  • SHA1

    a578408c2414f5c8018cf26d083a790834c05260

  • SHA256

    afca032a08aa9eea3a5f1f88fd6b598cc5242d68279ba9257c3bc08494400f02

  • SHA512

    47b0924e585a5fdec511d2aa3b0363f8538ea286ace550191fb036531334ff89d12e70467bb774d83aa76f613c6b7bc57e320745f27641fd68dc5efe6079017d

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443

50.243.30.51:6601

162.241.204.234:6516

rc4.plain
rc4.plain

Targets

    • Target

      57e910e74454ad625ab7b12954572263.dll

    • Size

      196KB

    • MD5

      57e910e74454ad625ab7b12954572263

    • SHA1

      a578408c2414f5c8018cf26d083a790834c05260

    • SHA256

      afca032a08aa9eea3a5f1f88fd6b598cc5242d68279ba9257c3bc08494400f02

    • SHA512

      47b0924e585a5fdec511d2aa3b0363f8538ea286ace550191fb036531334ff89d12e70467bb774d83aa76f613c6b7bc57e320745f27641fd68dc5efe6079017d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks