Analysis

  • max time kernel
    19s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    22-06-2021 09:21

General

  • Target

    ab5e72373919ad550194fa484cee606934efff4632ece8dde5ca85586f345c50.dll

  • Size

    160KB

  • MD5

    6a588db915d6d119caaa1c4f95b48ba6

  • SHA1

    7cdee02ca84af8fb2cb082d9b5fb2df6113211f9

  • SHA256

    ab5e72373919ad550194fa484cee606934efff4632ece8dde5ca85586f345c50

  • SHA512

    4cc5fe528f5bb1a9064efa47af1f9491a0eee060e65467e8aeb1a5bb788819eac2faf0fdb690906c38a75cdf31271d68c1df95bcb9e96fa287eab9f8aaec9d54

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5e72373919ad550194fa484cee606934efff4632ece8dde5ca85586f345c50.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5e72373919ad550194fa484cee606934efff4632ece8dde5ca85586f345c50.dll,#1
      2⤵
      • Checks whether UAC is enabled
      PID:3220

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3220-114-0x0000000000000000-mapping.dmp
  • memory/3220-115-0x00000000736D0000-0x00000000736FE000-memory.dmp
    Filesize

    184KB

  • memory/3220-117-0x0000000000730000-0x0000000000736000-memory.dmp
    Filesize

    24KB