dridex | b2cb49e4e63b41c50e7f2f69c3cf4fea77d81507361363542f66d942e279f6b5

General

Target

Document#974529430157.vbs
Size

987KB
MD5

d3e868f6112ee5c6a414b6f3087a5276
SHA1

2cc732a9b0620c15bebf1bbfe4b9dc8c0a22f8c9
SHA256

72baaecfb7c235e5ecd08aa1d8d8e210edc452f230ece050e1e02badbafadf67
SHA512

5542f7f4da1aa4684b1fef8407f81a07d20fa662ed2f94ccb9196cf77c78e7f89e4c9994c6d2b7b52c9c1aefdb608becc56b813ac49a7dc6ee41b7a5295cdf8d

Score

10^/10

dridex 10555 botnet

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

79.137.83.50:443

173.212.212.173:3074

80.86.81.31:3389

85.25.185.155:691

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

524 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

1180 regsvr32.exe

pid	process
524	regsvr32.exe

pid	process
1180	regsvr32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.execmd.exeregsvr32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1540	2028	WScript.exe	cmd.exe
PID 2028 wrote to memory of 1540	2028	WScript.exe	cmd.exe
PID 2028 wrote to memory of 1540	2028	WScript.exe	cmd.exe
PID 1540 wrote to memory of 1180	1540	cmd.exe	regsvr32.exe
PID 1540 wrote to memory of 1180	1540	cmd.exe	regsvr32.exe
PID 1540 wrote to memory of 1180	1540	cmd.exe	regsvr32.exe
PID 1540 wrote to memory of 1180	1540	cmd.exe	regsvr32.exe
PID 1540 wrote to memory of 1180	1540	cmd.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 524	1180	regsvr32.exe	regsvr32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document#974529430157.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c guiosdfpoc & reGs^VR32 -s C:\ProgramData\rlwTHNkP.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\system32\regsvr32.exe
reGsVR32 -s C:\ProgramData\rlwTHNkP.dll
3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\regsvr32.exe
-s C:\ProgramData\rlwTHNkP.dll
4⤵
- Loads dropped DLL
PID:524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\rlwTHNkP.dll
MD5
e5910bf2083088d33fdc797e50ed26cd

SHA1
e91153cf7af73b10c1b8bc88c4b34f41566ed9f0

SHA256
9a082f2f3bb26e4993aec76affbf3ca2f5f742c9685d2c4ef9a819e4530df9a8

SHA512
c7543844ad4f4ef18f1ce8f8a0b49c0b2d3e5589c7c0e307e2f08839448d6c6b0b4d5ad43ca7edc74af9393fb462c22dfa355ba4aee79f80b5f2905e0d31fb26

Download Submit
\ProgramData\rlwTHNkP.dll
MD5
e5910bf2083088d33fdc797e50ed26cd

SHA1
e91153cf7af73b10c1b8bc88c4b34f41566ed9f0

SHA256
9a082f2f3bb26e4993aec76affbf3ca2f5f742c9685d2c4ef9a819e4530df9a8

SHA512
c7543844ad4f4ef18f1ce8f8a0b49c0b2d3e5589c7c0e307e2f08839448d6c6b0b4d5ad43ca7edc74af9393fb462c22dfa355ba4aee79f80b5f2905e0d31fb26

Download Submit
memory/524-69-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/524-71-0x0000000072720000-0x000000007274C000-memory.dmp

Filesize
176KB

Download
memory/524-72-0x0000000072720000-0x0000000073696000-memory.dmp

Filesize
15.5MB

Download
memory/524-74-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2028-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing