dridex | a124c781beff018c039d54c6820d0b28ef62b0305412ce6bf079fa5ee12595e1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-en-20211104
submitted
17/11/2021, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Dridex.777.23872.21791.dll
Size 652KB
Sample211117-21nzxaecc5
SHA256 a124c781beff018c039d54c6820d0b28ef62b0305412ce6bf079fa5ee12595e1
MD5 0fe7e4f4a483a4e23a77274da9441101
SHA1 5d85b35b37c57f2acf765b686451dbb0f5ba48c8
SHA512 1d6d6409c885c0bb1869d974f0b68842c5c79d92a31f7938a0c7487e361ff93951f4bcbd612cfe13c517e019d5538255180c4940b147f99e5f4389cb9eff8a20
MD5 SHA1 SHA512

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

54.37.70.105:443
198.199.70.22:6602
164.68.99.3:5007
142.93.218.86:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1736-57-0x0000000074AB0000-0x0000000074B54000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27
PID 1632 wrote to memory of 1736	1632	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.23872.21791.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.23872.21791.dll,#1
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-56-0x0000000076241000-0x0000000076243000-memory.dmp

Download

memory/1736-57-0x0000000074AB0000-0x0000000074B54000-memory.dmp

Download

memory/1736-59-0x0000000000170000-0x0000000000176000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads