dridex | ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75 | Triage

Analysis

max time kernel
53s
max time network
43s
platform
windows10_x64
resource
win10v20201028
submitted
29-03-2021 15:53

Sharing

Report Analysis Logs

General

Target

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
Size

368KB
MD5

f16549beb46741a7ab052173af4c620d
SHA1

b117adde9c307494d83f6e76dacefedee1f73380
SHA256

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75
SHA512

38b5a9852d0895ee8d4df64b3b1824e3accf0458b2eb28a8f162437de30b903fca5ec66627e35b5ade116833b96b99761bb4a8e216e53417a0bcf5a3d809e973

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

210.65.244.176:443

37.34.58.210:6601

77.220.64.141:5037

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/2116-3-0x0000000073A60000-0x0000000073A9D000-memory.dmp	dridex_ldr
behavioral1/memory/2116-4-0x0000000073A60000-0x0000000073A9D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 832 wrote to memory of 2116	832	regsvr32.exe	regsvr32.exe
PID 832 wrote to memory of 2116	832	regsvr32.exe	regsvr32.exe
PID 832 wrote to memory of 2116	832	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
2⤵
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-2-0x0000000000000000-mapping.dmp

Download
memory/2116-3-0x0000000073A60000-0x0000000073A9D000-memory.dmp

Filesize
244KB

Download
memory/2116-4-0x0000000073A60000-0x0000000073A9D000-memory.dmp

Filesize
244KB

Download
memory/2116-5-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download