Overview

overview

10

Static

static

65edcfa02e...97.exe

windows7_x64

10

65edcfa02e...97.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    169s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08-05-2022 06:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    65edcfa02ed54445bd9a4efa1586cee02712271155b669cffb3db35c5a252097.exe

  • Size

    432KB

  • MD5

    635146e05f126794d8518e34d7b743e1

  • SHA1

    8e5e4a581672a3bd8b7b0a336dfeffee48afc550

  • SHA256

    65edcfa02ed54445bd9a4efa1586cee02712271155b669cffb3db35c5a252097

  • SHA512

    3cfb0e7f8b073d02d499d3193aafdb9ae33c1131d0175d9257d162c756a78b2cb0195beccde6ae963834e0ed40aa3c7a1606d6fae485f85d5f46fe9870cdd717

Score
10/10
dridex10111botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.9.178.143:443

185.230.161.62:3389

2.58.16.89:8443
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex Loader 'dmod' strings 1 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader

Processes

  • C:\Users\Admin\AppData\Local\Temp\65edcfa02ed54445bd9a4efa1586cee02712271155b669cffb3db35c5a252097.exe
    "C:\Users\Admin\AppData\Local\Temp\65edcfa02ed54445bd9a4efa1586cee02712271155b669cffb3db35c5a252097.exe"
    1⤵
      PID:2916

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2916-130-0x00000000021A0000-0x00000000021D9000-memory.dmp
      Filesize

      228KB

      Download
    • memory/2916-131-0x0000000000400000-0x000000000046F000-memory.dmp
      Filesize

      444KB

      Download