dridex | hxxps://myallexit[.]xyz/promoexit | Triage

Submit
Reports

Overview

overview

Static

static

URLScan

urlscan

https://myallexit.xy...

windows10_x64

Sharing

General

Target

https://myallexit.xyz/promoexit
Sample

210323-dnkdmbrvm2

Score

10^/10

dridex 10111 botnet cryptone discovery evasion loader packer trojan

Static task

static1

URLScan task

urlscan1

Sample

https://myallexit.xyz/promoexit

Behavioral task

behavioral1

Sample

https://myallexit.xyz/promoexit

Resource

win10v20201028

dridex 10111 botnet cryptone discovery evasion loader packer trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

188.165.17.91:8443

81.0.236.90:6601

rc4.plain

rc4.plain

Targets

- Target
  
  https://myallexit.xyz/promoexit
Score

10^/10

dridex 10111 botnet cryptone discovery evasion loader packer trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

dridex10111botnetcryptonediscoveryevasionloaderpackertrojan

© 2018-2024

Terms | Privacy