dridex | 309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142

Analysis

max time kernel
57s
max time network
115s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142.dll
Size 560KB
Sample210331-cabdkqf5fs
SHA256 309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142
MD5 48c0a51d7e05e74f6ab6e344428aa64d
SHA1 0f2395636934de06e93293898217a148c5b7da0c
SHA512 d87e93e3ebbc73fb6c0a14fbb993f96b0d98ae78b61ea4add9542b922112d3d90e223a5819506259d21c8d0b43ac9256dae55e7f4863f89f7aed36636cfdbc2e
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1224-5-0x0000000074A30000-0x0000000074A6D000-memory.dmp	dridex_ldr
behavioral1/memory/1224-6-0x0000000074A30000-0x0000000074A6D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26
PID 1624 wrote to memory of 1224	1624	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142.dll
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-4-0x0000000075F21000-0x0000000075F23000-memory.dmp

Download

memory/1224-5-0x0000000074A30000-0x0000000074A6D000-memory.dmp

Download

memory/1224-6-0x0000000074A30000-0x0000000074A6D000-memory.dmp

Download

memory/1224-7-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1624-2-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Download

memory/1648-8-0x000007FEF6460000-0x000007FEF66DA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads