dridex | 9354d9a23f836f3dceec5ae209ab29172d0ee6c684e204f42b2401d7bc82de57 | Triage

Analysis

max time kernel
88s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09-03-2022 01:37

Sharing

Report Analysis Logs

General

Target

9354d9a23f836f3dceec5ae209ab29172d0ee6c684e204f42b2401d7bc82de57.dll
Size

398KB
MD5

88997d4aee8771ab73b4d1250cff3fa2
SHA1

e7a72baa7561c812207d716b26156e46781848e3
SHA256

9354d9a23f836f3dceec5ae209ab29172d0ee6c684e204f42b2401d7bc82de57
SHA512

1c1b22d275f40957ac7f2fdc0fc096352960e4a055c3a6214cff67f45550031321c31b92e684c334152b4549ee83cd2cb8245e7679076c6c9cfc5290926ba8de

Score

10^/10

dridex 10555 botnet

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

194.225.58.216:443

178.254.40.132:691

216.172.165.70:3889

198.57.200.100:3786

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1912 wrote to memory of 2120	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 2120	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 2120	1912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9354d9a23f836f3dceec5ae209ab29172d0ee6c684e204f42b2401d7bc82de57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9354d9a23f836f3dceec5ae209ab29172d0ee6c684e204f42b2401d7bc82de57.dll,#1
2⤵
PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-133-0x0000000003310000-0x000000000334D000-memory.dmp

Filesize
244KB

Download
memory/2120-134-0x0000000004C90000-0x0000000004CCD000-memory.dmp

Filesize
244KB

Download