dridex | 8a24f75188b63723ee4d0dd65e40282723971e42687eaa03e6800e2a4435f0f7 | Triage

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 15:32

Sharing

Report Analysis Logs

General

Target

8a24f75188b63723ee4d0dd65e40282723971e42687eaa03e6800e2a4435f0f7.exe
Size

343KB
MD5

e864ff56570b9ab3f640779e1dfda3f2
SHA1

f9a0892ac08115e0876e1e7cabc89369a963a53c
SHA256

8a24f75188b63723ee4d0dd65e40282723971e42687eaa03e6800e2a4435f0f7
SHA512

4138eb77fe76832d218d63c9102200528a83e8b4027e7838eceae199f6af2d4f388fe0c51987d18f088ac1cc6632d4f0caa570866920283bdd912c48de2a43a0

Score

10^/10

dridex botnet loader

Malware Config

Extracted

Family

dridex

C2

46.105.131.75:443

198.61.168.254:443

69.55.238.203:3389

198.199.106.229:5900

178.254.38.200:884

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1524-54-0x0000000000820000-0x0000000000876000-memory.dmp	dridex_ldr

C:\Users\Admin\AppData\Local\Temp\8a24f75188b63723ee4d0dd65e40282723971e42687eaa03e6800e2a4435f0f7.exe
"C:\Users\Admin\AppData\Local\Temp\8a24f75188b63723ee4d0dd65e40282723971e42687eaa03e6800e2a4435f0f7.exe"
1⤵
PID:1524

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-54-0x0000000000820000-0x0000000000876000-memory.dmp

Filesize
344KB

Download
memory/1524-57-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download