dridex | b18028ac07b48288dd041e9b3e29f4fd459f70b8a3e4ca81d37aee68a9711115 | Triage

Analysis

max time kernel
113s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 02:53

Sharing

Report Analysis Logs

General

Target

b18028ac07b48288dd041e9b3e29f4fd459f70b8a3e4ca81d37aee68a9711115.dll
Size

312KB
MD5

1ce34090fcf71f9238fd09c5e8e1812b
SHA1

cb64a6a8f52e7aec11cba5828622823b0ea09013
SHA256

b18028ac07b48288dd041e9b3e29f4fd459f70b8a3e4ca81d37aee68a9711115
SHA512

685e9879ec156c3b8c3ae9aca2d9deda0fdc31f64f9c59e609fac3896bff3ba976684c3e6423137c5c55be318bca087b60e3e04859ade5934ef349bbf39759e4

Score

10^/10

dridex botnet loader

Malware Config

Extracted

Family

dridex

C2

194.99.22.193:443

178.63.67.20:691

75.127.14.171:3389

134.213.221.29:8443

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 3 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2652-132-0x0000000074F60000-0x0000000074F81000-memory.dmp	dridex_ldr
behavioral2/memory/2652-133-0x0000000074F60000-0x00000000758C3000-memory.dmp	dridex_ldr
behavioral2/memory/2652-135-0x0000000074F60000-0x00000000758C3000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4604 wrote to memory of 2652	4604	rundll32.exe	rundll32.exe
PID 4604 wrote to memory of 2652	4604	rundll32.exe	rundll32.exe
PID 4604 wrote to memory of 2652	4604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b18028ac07b48288dd041e9b3e29f4fd459f70b8a3e4ca81d37aee68a9711115.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b18028ac07b48288dd041e9b3e29f4fd459f70b8a3e4ca81d37aee68a9711115.dll,#1
2⤵
PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-130-0x0000000000000000-mapping.dmp

Download
memory/2652-131-0x0000000074F60000-0x00000000758C3000-memory.dmp

Filesize
9.4MB

Download
memory/2652-132-0x0000000074F60000-0x0000000074F81000-memory.dmp

Filesize
132KB

Download
memory/2652-133-0x0000000074F60000-0x00000000758C3000-memory.dmp

Filesize
9.4MB

Download
memory/2652-135-0x0000000074F60000-0x00000000758C3000-memory.dmp

Filesize
9.4MB

Download