dridex | 4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80

Analysis

max time kernel
56s
max time network
117s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80.dll
Size 560KB
Sample210331-4cldydlxps
SHA256 4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80
MD5 7892af30c1da21ebe84e516dc21cce5e
SHA1 0a7ceb5a578098734f84208d31e103bbf1ef6d3d
SHA512 4dfc95a53f23740c514b405513bbcd7810bf2bcfca75539e7dc49b774f7b63a30d2cbf0d94aa4cd6c0feec55df0f058e53a5af0dce217f9a93601152c7069c54
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1548-5-0x0000000074340000-0x000000007437D000-memory.dmp	dridex_ldr
behavioral1/memory/1548-6-0x0000000074340000-0x000000007437D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26
PID 2004 wrote to memory of 1548	2004	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80.dll
  2⤵
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-4-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Download

memory/1548-5-0x0000000074340000-0x000000007437D000-memory.dmp

Download

memory/1548-6-0x0000000074340000-0x000000007437D000-memory.dmp

Download

memory/1548-7-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/1672-8-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp

Download

memory/2004-2-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads