dridex | 0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2

Analysis

max time kernel
35s
max time network
93s
platform
windows7_x64
resource
win7v20201028
submitted
30/03/2021, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2.dll
Size 564KB
Sample210330-bmtetdejfe
SHA256 0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2
MD5 72bc1fccc975523a786a77283df0c783
SHA1 1ddd26c5a2771abc581449309df2a983873adb10
SHA512 d576416a9303bfb6c4c4a6e4d8375d169281f04c3f98cb04231e1c3870841250b8ae2fd0c25b94bedfbc8a8d3a2913e0b5f4180f6abae458ce021dbdfc3bf2ee
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1440-5-0x0000000073FD0000-0x000000007400D000-memory.dmp	dridex_ldr
behavioral1/memory/1440-6-0x0000000073FD0000-0x000000007400D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26
PID 1904 wrote to memory of 1440	1904	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2.dll
  2⤵
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-8-0x000007FEF6080000-0x000007FEF62FA000-memory.dmp

Download

memory/1440-4-0x0000000075781000-0x0000000075783000-memory.dmp

Download

memory/1440-5-0x0000000073FD0000-0x000000007400D000-memory.dmp

Download

memory/1440-6-0x0000000073FD0000-0x000000007400D000-memory.dmp

Download

memory/1440-7-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/1904-2-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads