dridex | dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd

Analysis

max time kernel
57s
max time network
113s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd.dll
Size 560KB
Sample210331-pkve8terb2
SHA256 dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd
MD5 cf272dc03d22541acac633d1b6497249
SHA1 5f2b3c708e6490e0042df4d601c43ac57ac79c96
SHA512 97ffda62feb666da9b52e24de658214208d9df6d6a7fbbf3bba58df4efba02e7320f9a7ee49ade6397cd125623d6ebf87012d7ec79aca55f9d99679b34fbbb36
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1492-5-0x0000000074D50000-0x0000000074D8D000-memory.dmp	dridex_ldr
behavioral1/memory/1492-6-0x0000000074D50000-0x0000000074D8D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26
PID 1676 wrote to memory of 1492	1676	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc764f5276566877f739be0dfafdf384e9e9afd978f6db0183bb127ae373dddd.dll
  2⤵
  PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-4-0x0000000075A41000-0x0000000075A43000-memory.dmp

Download

memory/1492-5-0x0000000074D50000-0x0000000074D8D000-memory.dmp

Download

memory/1492-6-0x0000000074D50000-0x0000000074D8D000-memory.dmp

Download

memory/1492-7-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1612-8-0x000007FEF6780000-0x000007FEF69FA000-memory.dmp

Download

memory/1676-2-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads