dridex | b2fb416b8bad4ba1aa249c51944177e88fee1616653c01a4b131a2c79aa86ba4

Analysis

max time kernel
3s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

161726ece301d6ce29288d425e1ed053.dll
Size

2.0MB
MD5

161726ece301d6ce29288d425e1ed053
SHA1

2bee795e6751cb88dcfc24a07a43772eec1929b6
SHA256

b2fb416b8bad4ba1aa249c51944177e88fee1616653c01a4b131a2c79aa86ba4
SHA512

42eab0458c2c0a12900f1c15ad25c6217d14f5d9edd59ade2c888b3bd59ff5ff4d744b7ce2e3b3416cedc5200436b5ff275e9361f0d9d333a2f806248b788813
SSDEEP

12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1NT:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnbV

Score

10^/10

dridex botnet payload

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1380-5-0x0000000002EA0000-0x0000000002EA1000-memory.dmp	dridex_stager_shellcode

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1108	regsvr32.exe
1108	regsvr32.exe
1108	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\161726ece301d6ce29288d425e1ed053.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

C:\Windows\system32\Utilman.exe
C:\Windows\system32\Utilman.exe
1⤵
PID:2476

C:\Users\Admin\AppData\Local\oRsnE1pbX\Utilman.exe
C:\Users\Admin\AppData\Local\oRsnE1pbX\Utilman.exe
1⤵
PID:2508

C:\Users\Admin\AppData\Local\hB0xAQ\msdtc.exe
C:\Users\Admin\AppData\Local\hB0xAQ\msdtc.exe
1⤵
PID:2724

C:\Windows\system32\msdtc.exe
C:\Windows\system32\msdtc.exe
1⤵
PID:1640

C:\Windows\system32\icardagt.exe
C:\Windows\system32\icardagt.exe
1⤵
PID:2180

C:\Users\Admin\AppData\Local\DHZ\icardagt.exe
C:\Users\Admin\AppData\Local\DHZ\icardagt.exe
1⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1108-1-0x00000000000B0000-0x00000000000B7000-memory.dmp

Filesize
28KB

Download
memory/1108-8-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-32-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-9-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-26-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-35-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-44-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-46-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-55-0x0000000077760000-0x0000000077762000-memory.dmp

Filesize
8KB

Download
memory/1380-54-0x0000000077601000-0x0000000077602000-memory.dmp

Filesize
4KB

Download
memory/1380-64-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-70-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-73-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-53-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-29-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-43-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-42-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-41-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-40-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-39-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-38-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-37-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-36-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-34-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-33-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-11-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-17-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-31-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-45-0x0000000002E00000-0x0000000002E07000-memory.dmp

Filesize
28KB

Download
memory/1380-28-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-27-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-25-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-24-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-23-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-22-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-21-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-20-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-19-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-18-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-16-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-15-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-14-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-13-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-12-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-10-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-30-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-4-0x00000000774F6000-0x00000000774F7000-memory.dmp

Filesize
4KB

Download
memory/1380-7-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1380-5-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/1380-161-0x00000000774F6000-0x00000000774F7000-memory.dmp

Filesize
4KB

Download
memory/1492-130-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/2508-82-0x0000000140000000-0x0000000140239000-memory.dmp

Filesize
2.2MB

Download
memory/2508-84-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/2724-106-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download