Analysis
- max time kernel
51s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
25/07/2024, 01:51
General
- Target LisectAVT_2403002C_79.dll
- Size 236KB
- Sample240725-b9ymla1ejp
- SHA256 0a659d5bb75bbd00e6172f2126ab8fff0e35c45275074109b29c809826a541c4
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
111
C2
-
52.73.70.149:443
-
8.4.9.152:3786
-
185.246.87.202:3098
-
50.116.111.64:5353
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_79.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_79.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3560-0-0x0000000075230000-0x000000007526D000-memory.dmp
memory/3560-2-0x0000000000980000-0x0000000000986000-memory.dmp
memory/3560-3-0x0000000075230000-0x000000007526D000-memory.dmp