Analysis

  • max time kernel
    36s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 05:39

General

  • Target

    IDDNOMAsIvDkkklgbtq.dll

  • Size

    512KB

  • MD5

    a8310b450f4be0f4d873d743f4e1b902

  • SHA1

    3b07e8955ffd27fb919a095e0d2cb39922b59b2f

  • SHA256

    69c083542e53579cfd344f93d7109f13a676adf4d73fa41425b3b0fa1dc702e4

  • SHA512

    ccc76c2fb3e7b6271fc1cc47e1d5665709686256be7960c23f0be9e326c19b078f8015585d26f39ae6e37231101b7b44e7ada130dba0047c7990a7c0dbe23537

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

51.159.52.196:443

134.209.247.135:6602

194.233.68.48:5228

89.31.56.58:593

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDDNOMAsIvDkkklgbtq.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDDNOMAsIvDkkklgbtq.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 300
        3⤵
        • Program crash
        PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/624-59-0x0000000000000000-mapping.dmp
  • memory/2024-54-0x0000000000000000-mapping.dmp
  • memory/2024-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
    Filesize

    8KB

  • memory/2024-56-0x0000000074E80000-0x0000000074F01000-memory.dmp
    Filesize

    516KB

  • memory/2024-58-0x00000000001B0000-0x00000000001B6000-memory.dmp
    Filesize

    24KB