Analysis

  • max time kernel
    43s
  • max time network
    75s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    04-05-2021 15:12

General

  • Target

    cbdc68b78c872bd9bb0063d49fc3a5c84399d1e23157f5f54cf3c1c61cba52c9.dll

  • Size

    160KB

  • MD5

    bcf0e33427a60fb7d0fed13cb98ed041

  • SHA1

    1b68b0e0b9494b5400e31dfc9be98cad3a5367a5

  • SHA256

    cbdc68b78c872bd9bb0063d49fc3a5c84399d1e23157f5f54cf3c1c61cba52c9

  • SHA512

    d24c4cf17e1276dac018e6e8369bfefac3e09368b9880aac74117cdbccfb049638c262b59fd333660052675398bf765909d3c202a1eb270bb608855418dee0d0

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbdc68b78c872bd9bb0063d49fc3a5c84399d1e23157f5f54cf3c1c61cba52c9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbdc68b78c872bd9bb0063d49fc3a5c84399d1e23157f5f54cf3c1c61cba52c9.dll,#1
      2⤵
      • Checks whether UAC is enabled
      PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4056-114-0x0000000000000000-mapping.dmp
  • memory/4056-115-0x0000000074480000-0x00000000744AE000-memory.dmp
    Filesize

    184KB

  • memory/4056-117-0x0000000000EF0000-0x0000000000EF6000-memory.dmp
    Filesize

    24KB