dridex | fe9f82e1175d3a18ca3e0244318d2e485ed7a51b475bc366ba768af62a83d875

Analysis

max time kernel
14s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
04-07-2021 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b478c97213c493e88ad38fa017db4ab.exe
Size

1.0MB
MD5

5b478c97213c493e88ad38fa017db4ab
SHA1

219474316e41df563322149b653cb160c0d49167
SHA256

fe9f82e1175d3a18ca3e0244318d2e485ed7a51b475bc366ba768af62a83d875
SHA512

58e8fb42a92620a1ec67169d5214409eec3b873634a3fe0c98889ed25401ab0cc97a0bcec16d31eefc1b8706cfc9e2ecd8271c5932f0c861f1f10bd57b62d16f

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

104.168.155.129:443

142.4.219.173:4664

176.31.117.84:9443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

5b478c97213c493e88ad38fa017db4ab.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5b478c97213c493e88ad38fa017db4ab.exe

C:\Users\Admin\AppData\Local\Temp\5b478c97213c493e88ad38fa017db4ab.exe
"C:\Users\Admin\AppData\Local\Temp\5b478c97213c493e88ad38fa017db4ab.exe"
1⤵
- Checks whether UAC is enabled
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-115-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/584-114-0x0000000000670000-0x00000000006AC000-memory.dmp

Filesize
240KB

Download