dridex | 49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258

General

Target

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe
Size

132KB
MD5

1acc8ff2531d3a3feef29e6c06e21d3f
SHA1

403c88b82adb6709e5cbca51deb03d27574d6a74
SHA256

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258
SHA512

2187277319cdb1ecdef998d01f1fc7c074dbde97bca4c01e1981242360f7f812a87068c08f53ace3aa7b8164c5521048adc3bc2b333ba5fc34cbdf9f824be3a7

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

216.189.150.181:443

142.4.198.252:3389

216.98.148.156:1801

37.59.1.74:3389

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

pid	process
3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe
3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe
3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe
3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

description pid process

Token: SeRestorePrivilege 3844 49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

description	pid	process
Token: SeRestorePrivilege	3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe

description	pid	process	target process
PID 3844 wrote to memory of 2696	3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe	raserver.exe
PID 3844 wrote to memory of 2696	3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe	raserver.exe
PID 3844 wrote to memory of 2696	3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe	raserver.exe
PID 3844 wrote to memory of 2696	3844	49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe	raserver.exe

C:\Users\Admin\AppData\Local\Temp\49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe
"C:\Users\Admin\AppData\Local\Temp\49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\49b586dc8a056ceccbcc54bdef82c23dae71d3b90e0432bde498727e0e875258.exe"
2⤵
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-133-0x0000000000000000-mapping.dmp

Download
memory/2696-135-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-137-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-138-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-136-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-134-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-140-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-139-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/2696-141-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3844-130-0x0000000001000000-0x0000000001022000-memory.dmp

Filesize
136KB

Download
memory/3844-132-0x0000000000D40000-0x0000000000D46000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads