dridex | 615b16ee9b1b7be56e000f4fb0835f7b0ac8d0ced27396929ab2c2e47489ce64

Analysis

max time kernel
143s
max time network
143s
platform
windows10_x64
resource
win10-en-20211104
submitted
01-12-2021 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c45i3.exe
Size

975KB
MD5

f219b020c4af28acaaa29ab11d03b759
SHA1

2da3d0170cbfc790cd82a4f79119261da141c7e4
SHA256

615b16ee9b1b7be56e000f4fb0835f7b0ac8d0ced27396929ab2c2e47489ce64
SHA512

ccad5672bb0bb1e7b4e462025f621662219c868e5643546f5ab9f9e25a6fa657ec3827c6d5a87818132079fb19e5e01a8b7345973d3182c39af01ff1ea8edda3

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

186.250.48.117:443

92.240.254.110:6602

81.223.127.86:10172

86.49.161.18:9043

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

c45i3.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c45i3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c45i3.exe

C:\Users\Admin\AppData\Local\Temp\c45i3.exe
"C:\Users\Admin\AppData\Local\Temp\c45i3.exe"
1⤵
- Checks whether UAC is enabled
PID:4024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4024-118-0x00000000006B0000-0x00000000006EC000-memory.dmp

Filesize
240KB

Download
memory/4024-119-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download