dridex | 2fef01ec46bc56992c5719d335add15e15b3329790b943f52df9c340a1b6b369

Analysis

max time kernel
6s
max time network
112s
platform
windows7_x64
resource
win7v20210408
submitted
05-09-2021 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a926ce002ec36ee94869a97ffe6c5ca9.exe
Size

1.9MB
MD5

a926ce002ec36ee94869a97ffe6c5ca9
SHA1

aee181b411d3115d3d848b6b958f4749a5720b50
SHA256

2fef01ec46bc56992c5719d335add15e15b3329790b943f52df9c340a1b6b369
SHA512

9095c9850bacc788c41d67b6a180c254d8aa6b626ac2de7a9fe46d3a8f705aedb6d95873570070ae5d96fc414b1f2d1e48de0d416285168594f8316992e1ff7e

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

207.154.208.93:6225

103.92.200.13:9676

45.80.173.80:9676

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a926ce002ec36ee94869a97ffe6c5ca9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a926ce002ec36ee94869a97ffe6c5ca9.exe

C:\Users\Admin\AppData\Local\Temp\a926ce002ec36ee94869a97ffe6c5ca9.exe
"C:\Users\Admin\AppData\Local\Temp\a926ce002ec36ee94869a97ffe6c5ca9.exe"
1⤵
- Checks whether UAC is enabled
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1968-61-0x0000000000220000-0x000000000025C000-memory.dmp

Filesize
240KB

Download
memory/1968-62-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download