dridex | b25e2a9b4e658c038dacab83460dfaa656623cbec82b4e276cc7e3722f71089d

Analysis

max time kernel
148s
max time network
82s
platform
windows7_x64
resource
win7v20210408
submitted
11-10-2021 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac41b32112843274e4ffae34e11867bf.exe
Size

379KB
MD5

ac41b32112843274e4ffae34e11867bf
SHA1

11a692980e75cdae8dc704774b48d7248000e6ab
SHA256

b25e2a9b4e658c038dacab83460dfaa656623cbec82b4e276cc7e3722f71089d
SHA512

423498634fa7846ece448318adc5d6a30984c2e00451db0960b9d18c86fc7e85fd47d2fe030dcb9ec9289a5d368df930b0c8f1b1798dc0cc5c71b122bed5685a

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

212.112.86.37:9676

184.168.147.173:6225

72.52.96.202:8194

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ac41b32112843274e4ffae34e11867bf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ac41b32112843274e4ffae34e11867bf.exe

C:\Users\Admin\AppData\Local\Temp\ac41b32112843274e4ffae34e11867bf.exe
"C:\Users\Admin\AppData\Local\Temp\ac41b32112843274e4ffae34e11867bf.exe"
1⤵
- Checks whether UAC is enabled
PID:1080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-60-0x00000000003A0000-0x00000000003DC000-memory.dmp

Filesize
240KB

Download
memory/1080-61-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1080-62-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download