Analysis
- max time kernel
49s - max time network
107s - platform
windows7_x64 - resource
win7v20201028 - submitted
29/03/2021, 17:54
General
- Target 5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1.dll
- Size 579KB
- Sample210329-1159ba1ejs
- SHA256 5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
10444
C2
-
210.65.244.176:443
-
37.34.58.210:6601
-
77.220.64.141:5037
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1.dll2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1216-4-0x00000000750C1000-0x00000000750C3000-memory.dmp
memory/1216-5-0x0000000073A90000-0x0000000073ACD000-memory.dmp
memory/1216-6-0x0000000073A90000-0x0000000073ACD000-memory.dmp
memory/1216-7-0x0000000000180000-0x0000000000181000-memory.dmp
memory/1832-8-0x000007FEF6E90000-0x000007FEF710A000-memory.dmp
memory/1932-2-0x000007FEFB541000-0x000007FEFB543000-memory.dmp