dridex | 5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0

Analysis

max time kernel
150s
max time network
93s
platform
windows7_x64
resource
win7v20201028
submitted
29/03/2021, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0.dll
Size 368KB
Sample210329-g2rlcepy52
SHA256 5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0
MD5 8f49af3d022d4d808c7d6f9f5cec035d
SHA1 d7280461554343ca93a408c4a20b7c0de3c6b0d3
SHA512 870e155455eeb107d9a91fd7391dee43b4cc39bc861a818fe8f56744877fca06e9ea1ef1955c183e65811da980cb534c194044b2eebea62ff24281a0d4aecf57
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1468-5-0x0000000074440000-0x000000007447D000-memory.dmp	dridex_ldr
behavioral1/memory/1468-6-0x0000000074440000-0x000000007447D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25
PID 1924 wrote to memory of 1468	1924	regsvr32.exe	25

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0.dll
  2⤵
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-8-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Download

memory/1468-4-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/1468-5-0x0000000074440000-0x000000007447D000-memory.dmp

Download

memory/1468-6-0x0000000074440000-0x000000007447D000-memory.dmp

Download

memory/1468-7-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1924-2-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads