Analysis

  • max time kernel
    56s
  • max time network
    60s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    05-03-2021 03:07

General

  • Target

    fc123e475bd0c2dc00c470651ed35e56098a164c8a011d1387067019512e9b6d.dll

  • Size

    196KB

  • MD5

    7e29411fb147a05d8b6c9c3e983b263b

  • SHA1

    799506a393a9907a6aa1ddc66ff41eaba2d902e5

  • SHA256

    fc123e475bd0c2dc00c470651ed35e56098a164c8a011d1387067019512e9b6d

  • SHA512

    2a4aecd0c1fb7fc9ebed7ee2fda25c30a085b568216bff43fd93590d32c737749710e53a7c4824408c8333b81f3dac2e0fc781b7b77ca3ae41c9292c213792e3

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443

50.243.30.51:6601

162.241.204.234:6516

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc123e475bd0c2dc00c470651ed35e56098a164c8a011d1387067019512e9b6d.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc123e475bd0c2dc00c470651ed35e56098a164c8a011d1387067019512e9b6d.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Checks whether UAC is enabled
      PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/760-7-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp
    Filesize

    2.5MB

  • memory/1176-2-0x0000000000000000-mapping.dmp
  • memory/1176-3-0x0000000075ED1000-0x0000000075ED3000-memory.dmp
    Filesize

    8KB

  • memory/1176-4-0x00000000747C0000-0x00000000747F3000-memory.dmp
    Filesize

    204KB

  • memory/1176-5-0x0000000000110000-0x0000000000116000-memory.dmp
    Filesize

    24KB

  • memory/1176-6-0x00000000747C0000-0x00000000747DF000-memory.dmp
    Filesize

    124KB