dridex | 839b87bf97b74fd6a21dcfe99527df63f12ac79885a8c262b66a97dcb621c45c | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
18-03-2021 19:57

Sharing

Report Analysis Logs

General

Target

839b87bf97b74fd6a21dcfe99527df63f12ac79885a8c262b66a97dcb621c45c.exe
Size

585KB
MD5

9336058578735944a9a295dee74bc958
SHA1

cb1305f578b3b0988497265d227b8cf98ca7c9ef
SHA256

839b87bf97b74fd6a21dcfe99527df63f12ac79885a8c262b66a97dcb621c45c
SHA512

010eefe4ef7d915b9dd431fe3f321a2c8d4e0b8dd8d263d91efa8d678616cc4f204c0359197cd1e0b8a5a56cd07993791b85f29975f8ab7e26c5084db7647f10

Score

10^/10

dridex 10111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

188.165.17.91:8443

81.0.236.90:6601

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1968-2-0x0000000000400000-0x000000000043D000-memory.dmp	dridex_ldr
behavioral1/memory/1968-4-0x0000000000400000-0x000000000043D000-memory.dmp	dridex_ldr

C:\Users\Admin\AppData\Local\Temp\839b87bf97b74fd6a21dcfe99527df63f12ac79885a8c262b66a97dcb621c45c.exe
"C:\Users\Admin\AppData\Local\Temp\839b87bf97b74fd6a21dcfe99527df63f12ac79885a8c262b66a97dcb621c45c.exe"
1⤵
PID:1968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-2-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1968-4-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1968-3-0x0000000000220000-0x000000000025C000-memory.dmp

Filesize
240KB

Download