dridex | 1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
29/03/2021, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
g38ufhf.zip.dll
Size 360KB
Sample210329-rhmlgxpvss
SHA256 1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5
MD5 66c742042aaa43ebef2a44953ac9fe45
SHA1 d9bd5b1ef320045a48a25100984dbf82cbb9f32e
SHA512 4c6252b2f4e3967448d70a81d1dd4700bea19fbff5c5052501e33f398db3c5a4d3c5105e56c0ce9e490a3928c726e08cd5678d81cd61819390f0fc9c88f73316
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1432-5-0x0000000073CD0000-0x0000000073D0D000-memory.dmp	dridex_ldr
behavioral1/memory/1432-6-0x0000000073CD0000-0x0000000073D0D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26
PID 1648 wrote to memory of 1432	1648	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\g38ufhf.zip.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\g38ufhf.zip.dll
  2⤵
  PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-8-0x000007FEF5B70000-0x000007FEF5DEA000-memory.dmp

Download

memory/1432-4-0x0000000074D11000-0x0000000074D13000-memory.dmp

Download

memory/1432-5-0x0000000073CD0000-0x0000000073D0D000-memory.dmp

Download

memory/1432-6-0x0000000073CD0000-0x0000000073D0D000-memory.dmp

Download

memory/1432-7-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1648-2-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads