dridex | ea9f5c20d59fe7093f4ffa609510108b92c3c552d46c58a9aaf4b122a4473a90

Analysis

max time kernel
21s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
14/05/2021, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98a07ba5_by_Libranalysis.dll
Size 162KB
Sample210514-lv3vfg5v8a
SHA256 ea9f5c20d59fe7093f4ffa609510108b92c3c552d46c58a9aaf4b122a4473a90
MD5 98a07ba5323dbae3f85e5f91b555a910
SHA1 e39323f3aa8fd76d0654fee4a30196960f707826
SHA512 0e40766863c955bcef5bc0b6dfd5743aa99b423913eadd8bd95cc344688d8ca962d592ffc9105ae77fc76db30c87f917fadb2c34157f2d7daab3c694e86a6bab
MD5 SHA1 SHA512

Score

10^/10

dridex 40112 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

40112

107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/416-115-0x0000000073860000-0x000000007388E000-memory.dmp	dridex_ldr

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 416	2204	rundll32.exe	70
PID 2204 wrote to memory of 416	2204	rundll32.exe	70
PID 2204 wrote to memory of 416	2204	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98a07ba5_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98a07ba5_by_Libranalysis.dll,#1
  2⤵
  - Checks whether UAC is enabled
  PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-115-0x0000000073860000-0x000000007388E000-memory.dmp

Download

memory/416-117-0x0000000003300000-0x0000000003306000-memory.dmp