Analysis
- max time kernel
122s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
24/11/2021, 17:27
General
- Target 0e74eabfa1fb0f7c526ab0ea42c8738c.dll
- Size 768KB
- Sample211124-v1eynsdcej
- SHA256 a11603868f1a1bc1728c43b8ca3172021d3dbc0bbe554f436b41e71bbffbaf39
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
22203
C2
-
107.170.4.227:443
-
178.128.222.53:8116
-
185.148.168.15:4664
-
64.251.25.156:6602
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Blocklisted process makes network request 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e74eabfa1fb0f7c526ab0ea42c8738c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e74eabfa1fb0f7c526ab0ea42c8738c.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2644-116-0x0000000074210000-0x00000000742D0000-memory.dmp
memory/2644-119-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/2644-120-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/2644-121-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/2644-1156-0x0000000000B10000-0x0000000000B16000-memory.dmp