Analysis

  • max time kernel
    204s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 05:34

General

  • Target

    gfl7i3kp.dll

  • Size

    358KB

  • MD5

    84048d4a704ca3ed43cf15d44dceeb39

  • SHA1

    621c3e992ac5c7f944b491d7ca3e4f07b9a20087

  • SHA256

    e014812592b1f4a0ff43b95117404149bdcb1dc82924a0f90b7b5ac4699b8dcc

  • SHA512

    d05eb0fafa8580f1f6594b4f7d55b3d8d808e3b3af61fcc502135d55fe384c41e34a44032bd5711211751d0bdb0fe9d0645c62b153bd7ca2094f43a5fceb674e

Score
10/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

85.207.13.169:443

74.207.242.13:1688

176.58.101.200:49160

164.132.75.129:3388

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\gfl7i3kp.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\gfl7i3kp.dll
      2⤵
        PID:2044

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2044-130-0x0000000000000000-mapping.dmp

    • memory/2044-131-0x0000000000400000-0x0000000000468000-memory.dmp

      Filesize

      416KB

    • memory/2044-132-0x0000000000400000-0x0000000000468000-memory.dmp

      Filesize

      416KB