dridex | fa241e69ab0fe614283f53e81b31ea926ae1ea4e4bfbc051728f9b7277adef72 | Triage

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 10:08

Sharing

Report Analysis Logs

General

Target

fa241e69ab0fe614283f53e81b31ea926ae1ea4e4bfbc051728f9b7277adef72.exe
Size

172KB
MD5

6699fa15ef1ee8eb137d7a5ef73b22f9
SHA1

a791f706fe3a3ba405a67fc0720601f287dbff10
SHA256

fa241e69ab0fe614283f53e81b31ea926ae1ea4e4bfbc051728f9b7277adef72
SHA512

d3511b4718bdefc777130e3b58cc2560f70b13171c713b42e2373f5cc45ad653e8571b53588a627be49260d0848959381a96fdcecfce1767280e04b3e4d3ac8b

Score

10^/10

dridex botnet loader

Malware Config

Extracted

Family

dridex

C2

5.196.1.113:4433

82.146.55.23:691

131.0.103.194:3389

92.222.219.26:4433

178.62.19.173:3389

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1756-55-0x00000000000A0000-0x00000000000CC000-memory.dmp	dridex_ldr

C:\Users\Admin\AppData\Local\Temp\fa241e69ab0fe614283f53e81b31ea926ae1ea4e4bfbc051728f9b7277adef72.exe
"C:\Users\Admin\AppData\Local\Temp\fa241e69ab0fe614283f53e81b31ea926ae1ea4e4bfbc051728f9b7277adef72.exe"
1⤵
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x00000000000A0000-0x00000000000CC000-memory.dmp

Filesize
176KB

Download
memory/1756-58-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download