dridex | 412b57c9e83bf404bfacf087f3bf8edee7af584ab303f3222eb22ced5d7e5f54 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
02-05-2022 00:13

Sharing

Report Analysis Logs

General

Target

412b57c9e83bf404bfacf087f3bf8edee7af584ab303f3222eb22ced5d7e5f54.exe
Size

450KB
MD5

4ec71b3e86b5f61b54d6516d90cc0f41
SHA1

fef8c687dc109dfb662ada733bca5b0bb518ab6e
SHA256

412b57c9e83bf404bfacf087f3bf8edee7af584ab303f3222eb22ced5d7e5f54
SHA512

d68d32c9fc234dded9b5a172e5e024aeac6c48297704db51ba1623a3f18d01c8aa6776f3309055bf9bb13727c74669ef9a097e9216a32bbc6760dd80f78dfff1

Score

10^/10

dridex 10111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.9.178.143:443

185.230.161.62:3389

2.58.16.89:8443

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

Processes:

resource	yara_rule
behavioral1/memory/2044-56-0x0000000000400000-0x0000000000473000-memory.dmp	dridex_ldr_dmod

C:\Users\Admin\AppData\Local\Temp\412b57c9e83bf404bfacf087f3bf8edee7af584ab303f3222eb22ced5d7e5f54.exe
"C:\Users\Admin\AppData\Local\Temp\412b57c9e83bf404bfacf087f3bf8edee7af584ab303f3222eb22ced5d7e5f54.exe"
1⤵
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000220000-0x0000000000259000-memory.dmp

Filesize
228KB

Download
memory/2044-56-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download