dridex | 92bdad4e9b6c4077ed84b4cb2d278650002660aa387a677bde64c4d4f6d8e01d | Triage

Analysis

max time kernel
133s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 16:52

Sharing

Report Analysis Logs

General

Target

92bdad4e9b6c4077ed84b4cb2d278650002660aa387a677bde64c4d4f6d8e01d.dll
Size

368KB
MD5

291cc6e829519b5a980e5338621dcedb
SHA1

101098e15d6528da2f2be5b65b38c9a49608c22c
SHA256

92bdad4e9b6c4077ed84b4cb2d278650002660aa387a677bde64c4d4f6d8e01d
SHA512

22e23bba678ba7a7730a59b0be2e4d86faa0fe1810fea4f7e91fc48bf8cb12090bbbd4abb18afe9b2111ac71bd666470f6cdb9bd94f81163b8341c5804d5d933

Score

10^/10

dridex botnet

Malware Config

Extracted

Family

dridex

C2

37.247.54.134:443

192.232.207.243:8443

82.165.38.218:691

188.166.73.181:1443

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3780 wrote to memory of 4788	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 4788	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 4788	3780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92bdad4e9b6c4077ed84b4cb2d278650002660aa387a677bde64c4d4f6d8e01d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92bdad4e9b6c4077ed84b4cb2d278650002660aa387a677bde64c4d4f6d8e01d.dll,#1
2⤵
PID:4788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-130-0x0000000000000000-mapping.dmp

Download
memory/4788-132-0x0000000074F70000-0x0000000074FDD000-memory.dmp

Filesize
436KB

Download
memory/4788-131-0x0000000074F70000-0x0000000074F8D000-memory.dmp

Filesize
116KB

Download
memory/4788-134-0x0000000074F70000-0x0000000074FDD000-memory.dmp

Filesize
436KB

Download