dridex | 6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1

Analysis

max time kernel
37s
max time network
98s
platform
windows7_x64
resource
win7v20201028
submitted
30/03/2021, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1.dll
Size 564KB
Sample210330-jbmemdd3ta
SHA256 6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1
MD5 72a78f73900f015106d45b1d1d6149fe
SHA1 820d8d057c14f3b3a632fc5df43c0e3f66b88cd8
SHA512 088f8bd1b3d687a8f1d6c5b5bedbb30a20efa135dcf9e31970c277cf7926105da44d6c7bbc867ee0ddf184aa930ee23dc4cded5f06e9c95a64661362cfd04bb4
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

210.65.244.176:443
37.34.58.210:6601
77.220.64.141:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1944-5-0x0000000074790000-0x00000000747CD000-memory.dmp	dridex_ldr
behavioral1/memory/1944-6-0x0000000074790000-0x00000000747CD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26
PID 1616 wrote to memory of 1944	1616	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1.dll
  2⤵
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-8-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmp

Download

memory/1616-2-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Download

memory/1944-4-0x00000000765A1000-0x00000000765A3000-memory.dmp

Download

memory/1944-5-0x0000000074790000-0x00000000747CD000-memory.dmp

Download

memory/1944-6-0x0000000074790000-0x00000000747CD000-memory.dmp

Download

memory/1944-7-0x0000000000140000-0x0000000000141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads