dridex | 3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
29/03/2021, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589.dll
Size 579KB
Sample210329-hl1pgz2f8a
SHA256 3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589
MD5 e304592773f40ae15360ee26f7e771f3
SHA1 efcd4ebf664780fcb2442c479d95b9fdfbc04736
SHA512 7f2f94c860e8672af45a68c0fbd3c3691480892cf7fe8fb18ff9f328d04ac7971b8cb34992f45ad2d0b3b7ae8d8c9766ce61981fc42268aa64be67ef4cf219c4
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1192-5-0x00000000741B0000-0x00000000741ED000-memory.dmp	dridex_ldr
behavioral1/memory/1192-6-0x00000000741B0000-0x00000000741ED000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26
PID 1432 wrote to memory of 1192	1432	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589.dll
  2⤵
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-4-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Download

memory/1192-5-0x00000000741B0000-0x00000000741ED000-memory.dmp

Download

memory/1192-6-0x00000000741B0000-0x00000000741ED000-memory.dmp

Download

memory/1192-7-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/1236-8-0x000007FEF61D0000-0x000007FEF644A000-memory.dmp

Download

memory/1432-2-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads