Analysis

  • max time kernel
    18s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    29-06-2021 04:34

General

  • Target

    8f2e7c3dd7d40428eb020f4adc750e6e28dc95db6f0379cc9f0e59ad63dcc355.dll

  • Size

    158KB

  • MD5

    346f5e412fe02fd0b8e4453119d3049a

  • SHA1

    3a6189309dc0932a9f77b2d69a5072d50222a0c2

  • SHA256

    8f2e7c3dd7d40428eb020f4adc750e6e28dc95db6f0379cc9f0e59ad63dcc355

  • SHA512

    73055e6e15744e4f43167d41253d2f394fa26790a809e65af9772105fbb34bd99b3bf139965d567b4430ca7ee5fc1538814e9f8384e7be6acee25e429494f057

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f2e7c3dd7d40428eb020f4adc750e6e28dc95db6f0379cc9f0e59ad63dcc355.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f2e7c3dd7d40428eb020f4adc750e6e28dc95db6f0379cc9f0e59ad63dcc355.dll,#1
      2⤵
      • Checks whether UAC is enabled
      PID:496

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/496-114-0x0000000000000000-mapping.dmp

  • memory/496-115-0x0000000073860000-0x000000007388D000-memory.dmp

    Filesize

    180KB

  • memory/496-117-0x0000000000820000-0x000000000096A000-memory.dmp

    Filesize

    1.3MB