dridex | c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4

General

Target
08eaa5b865e64db4b0ade4bb9b21d5d5.dll
Size 750KB
Sample211027-sb6c8afcb9
SHA256 c212d2f1dfa7a4a33c145ab500894eb13ecde04016b8040b3d481a8a6b4298f4
MD5 08eaa5b865e64db4b0ade4bb9b21d5d5
SHA1 260c2b82f6586d5bff1ca813fe883f86d7413186
SHA512 3f21e2b111661b3ba962ae62fefbafcb5fd70c98005fc74adc639a09b7db97a776667ff14345381f80b8eb6ba458431680c771a40406acf1a4088e9f54a826a5
MD5 SHA1 SHA512

Score

10^/10

dridex 10555 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	740	rundll32.exe
6	740	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27
PID 940 wrote to memory of 740	940	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08eaa5b865e64db4b0ade4bb9b21d5d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08eaa5b865e64db4b0ade4bb9b21d5d5.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Checks whether UAC is enabled
  PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-56-0x0000000074A31000-0x0000000074A33000-memory.dmp

Download

memory/740-57-0x0000000074430000-0x00000000744F9000-memory.dmp

Download

memory/740-58-0x0000000074430000-0x000000007446D000-memory.dmp

Download

memory/740-59-0x0000000074430000-0x00000000744F9000-memory.dmp

Download

memory/740-61-0x0000000000120000-0x0000000000121000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads