dridex | ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e

Analysis

max time kernel
36s
max time network
93s
platform
windows7_x64
resource
win7v20201028
submitted
29/03/2021, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e.dll
Size 368KB
Sample210329-jcpradrnbs
SHA256 ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e
MD5 44dcdfd1873198f50c5dd4dbb1fe8f44
SHA1 28fb8eed7c243dc5715b71564dd11c953f969aca
SHA512 c6c56220fa0d4541957ce6bfd57086482f971c3988e5cbc1687e4e4303c1f0f84c4851a42481d2ceebe061c7ed30cbb81f08df92cb964bea1f876a7b9f40e679
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1604-5-0x0000000073EB0000-0x0000000073EED000-memory.dmp	dridex_ldr
behavioral1/memory/1604-6-0x0000000073EB0000-0x0000000073EED000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25
PID 1752 wrote to memory of 1604	1752	regsvr32.exe	25

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e.dll
  2⤵
  PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-8-0x000007FEF7160000-0x000007FEF73DA000-memory.dmp

Download

memory/1604-4-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

Download

memory/1604-5-0x0000000073EB0000-0x0000000073EED000-memory.dmp

Download

memory/1604-6-0x0000000073EB0000-0x0000000073EED000-memory.dmp

Download

memory/1604-7-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1752-2-0x000007FEFB811000-0x000007FEFB813000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads