dridex

General

Target
2bb45dd8c9f7f648266a608649033f4c.dll
Size 196KB
Sample210304-ctxk3ck812
SHA256 f4f3228f55ed310da0960219d5b2b497c5c76ec1fe5059160136791649158917
MD5 2bb45dd8c9f7f648266a608649033f4c
SHA1 4b734ef266d0f2049d0408ec6548b08a3f922cc7
SHA512 97b8262d9dbbecdfad08f9273f2cac75efb3c5cb0a930473f4bc55d7c595f24007ea1940ebf4c509c315f35c2178759ebc8eff56acd65b4ef7465918290cffb7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443
50.243.30.51:6601
162.241.204.234:6516

rc4.plain

Targets

- Target
  2bb45dd8c9f7f648266a608649033f4c.dll
- Size 196KB
- SHA256 f4f3228f55ed310da0960219d5b2b497c5c76ec1fe5059160136791649158917
- MD5 2bb45dd8c9f7f648266a608649033f4c
- SHA1 4b734ef266d0f2049d0408ec6548b08a3f922cc7
- SHA512 97b8262d9dbbecdfad08f9273f2cac75efb3c5cb0a930473f4bc55d7c595f24007ea1940ebf4c509c315f35c2178759ebc8eff56acd65b4ef7465918290cffb7
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2