Analysis

  • max time kernel
    34s
  • max time network
    94s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    19-04-2021 13:33

General

  • Target

    6385fc6db7fcad400241a1535d6fa42d5292d857e85e9f05c5d9d8d586a2f950.dll

  • Size

    639KB

  • MD5

    70dded12efc8d0e79b35825fa3232d1a

  • SHA1

    77c8401624c25c1e21edad4082c140c4e5dbd8c0

  • SHA256

    6385fc6db7fcad400241a1535d6fa42d5292d857e85e9f05c5d9d8d586a2f950

  • SHA512

    523e9357474c92542a5a7b1b924f1f74e1dd23ec09ed3decd2fffbeb67b6e54484de5f6921fd17b88003f7e03ee02f8d1b1ce4f4a2426693e6498311630661bf

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

146.185.170.249:443

62.75.251.60:6601

185.148.168.25:2303

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6385fc6db7fcad400241a1535d6fa42d5292d857e85e9f05c5d9d8d586a2f950.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6385fc6db7fcad400241a1535d6fa42d5292d857e85e9f05c5d9d8d586a2f950.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Checks whether UAC is enabled
      PID:1816

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1816-59-0x0000000000000000-mapping.dmp
  • memory/1816-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp
    Filesize

    8KB

  • memory/1816-62-0x0000000074870000-0x0000000074933000-memory.dmp
    Filesize

    780KB

  • memory/1816-61-0x0000000074870000-0x00000000748AD000-memory.dmp
    Filesize

    244KB

  • memory/1816-63-0x0000000000330000-0x0000000000331000-memory.dmp
    Filesize

    4KB