dridex | f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c

Analysis

max time kernel
17s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
21-07-2021 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56c09545b796f22000b20c84bf6b505b.dll
Size

175KB
MD5

56c09545b796f22000b20c84bf6b505b
SHA1

ba7998c8dbf5acdd5226ed9e1a70a8ee14065aaa
SHA256

f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c
SHA512

ca029b9818130764f9c1393993a1527e1982c019233be156b54702e9ef37b19dc97c501ce2040ec4ed18a062ebbd49c840daa396b58e2325ba09abeff79871a1

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3756-115-0x00000000755E0000-0x0000000075610000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

540 3756 WerFault.exe rundll32.exe

pid	pid_target	process	target process
540	3756	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe
540	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 540 WerFault.exe
Token: SeBackupPrivilege 540 WerFault.exe
Token: SeDebugPrivilege 540 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	540	WerFault.exe
Token: SeBackupPrivilege	540	WerFault.exe
Token: SeDebugPrivilege	540	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3968 wrote to memory of 3756	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 3756	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 3756	3968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56c09545b796f22000b20c84bf6b505b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56c09545b796f22000b20c84bf6b505b.dll,#1
2⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 636
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-114-0x0000000000000000-mapping.dmp

Download
memory/3756-115-0x00000000755E0000-0x0000000075610000-memory.dmp

Filesize
192KB

Download
memory/3756-117-0x0000000003460000-0x0000000003466000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads