dridex | 4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1

Analysis

max time kernel
37s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
01/04/2021, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1.dll
Size 381KB
Sample210401-le4yp22stj
SHA256 4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1
MD5 c87575a00ac99c93aef90c6d60ef8f10
SHA1 03bbd8fa4d2f5fee337ffb05237f5901cf1e7c2f
SHA512 8086c7e6dcdf36a98184058e31d490ffb1e0b9422959e02bb09d8225ce4e2c54e0aa4198c7bbbe66f268adaaa0e3f0c81b7991177460c9428634b85c32f08ade
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet discovery evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

10444

131.100.24.215:443
210.65.244.174:6601
195.201.199.53:2303

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/492-3-0x00000000735B0000-0x00000000735ED000-memory.dmp	dridex_ldr
behavioral2/memory/492-4-0x00000000735B0000-0x00000000735ED000-memory.dmp	dridex_ldr

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	492	rundll32.exe
18	492	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 492	636	rundll32.exe	69
PID 636 wrote to memory of 492	636	rundll32.exe	69
PID 636 wrote to memory of 492	636	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Checks whether UAC is enabled
  PID:492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-3-0x00000000735B0000-0x00000000735ED000-memory.dmp

Download

memory/492-4-0x00000000735B0000-0x00000000735ED000-memory.dmp

Download

memory/492-5-0x00000000030A0000-0x00000000030A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads