dridex | f3c2e6499c04665aa6e4aa270b46aa499f9459f64c4333a2d8c5e9f10e2eca27

Analysis

max time kernel
38s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
03/05/2021, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9110f858_by_Libranalysis.dll
Size 162KB
Sample210503-vbe3phbaze
SHA256 f3c2e6499c04665aa6e4aa270b46aa499f9459f64c4333a2d8c5e9f10e2eca27
MD5 9110f85808f7268ee33ffc903e312de0
SHA1 9613a37c9d9a9bacdfe6c66057112e4c95f51f1b
SHA512 2ea3a9610df8ca3045b419816c6f6a2674b7c3e0c0cd23d4220229534f1310ca0ddac29d1bad0711e7d0aa637ea1fb8f4b64c167f1439995380f187da5c24ee4
MD5 SHA1 SHA512

Score

10^/10

dridex 40112 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

40112

107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/820-115-0x0000000074400000-0x000000007442E000-memory.dmp	dridex_ldr

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 820	784	rundll32.exe	59
PID 784 wrote to memory of 820	784	rundll32.exe	59
PID 784 wrote to memory of 820	784	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9110f858_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9110f858_by_Libranalysis.dll,#1
  2⤵
  - Checks whether UAC is enabled
  PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-115-0x0000000074400000-0x000000007442E000-memory.dmp

Download

memory/820-117-0x0000000000350000-0x0000000000356000-memory.dmp