Analysis
- max time kernel
88s - max time network
152s - platform
windows7_x64 - resource
win7v20201028 - submitted
18/03/2021, 07:11
General
- Target 933e88b439d0b41e0a49ebbd73d44d5e0f9650b5212af3e6b0158fe00b99f8a4.dll
- Size 208KB
- Sample210318-art48gff1j
- SHA256 933e88b439d0b41e0a49ebbd73d44d5e0f9650b5212af3e6b0158fe00b99f8a4
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
111
C2
-
77.220.64.137:443
-
66.228.134.180:6601
-
199.204.214.26:7073
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\933e88b439d0b41e0a49ebbd73d44d5e0f9650b5212af3e6b0158fe00b99f8a4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\933e88b439d0b41e0a49ebbd73d44d5e0f9650b5212af3e6b0158fe00b99f8a4.dll,#12⤵
- Checks whether UAC is enabled
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2024-3-0x0000000075EA1000-0x0000000075EA3000-memory.dmp
memory/2024-4-0x0000000074770000-0x00000000747A6000-memory.dmp
memory/2024-5-0x00000000000B0000-0x00000000000B6000-memory.dmp
memory/2024-6-0x0000000074770000-0x0000000074791000-memory.dmp