dridex | cd2aedfa1d7113c4aa22764886c0918455e77408db27b0350c91ffdf61bb213d

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-en-20211104
submitted
17/11/2021, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll
Size 652KB
Sample211117-1yb2wsbbam
SHA256 cd2aedfa1d7113c4aa22764886c0918455e77408db27b0350c91ffdf61bb213d
MD5 4ac20af1cc1553937c1e1ca000e56be1
SHA1 b390aa3d6a8191d69787fbe170b106d26ff90dc5
SHA512 3fd811ff780f217798529abbc0c73efd1ceca5742c58417eb437b8c66e3803bc4eb9bab314f5948c73f697cff5fcf8f3d530a707121ca9ab23b15316adb3b5d6
MD5 SHA1 SHA512

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/472-57-0x0000000074560000-0x0000000074604000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28
PID 1364 wrote to memory of 472	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll,#1
  2⤵
  PID:472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/472-57-0x0000000074560000-0x0000000074604000-memory.dmp

Download

memory/472-59-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads