Analysis
- max time kernel
58s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
26/07/2024, 01:25
General
- Target 0a659d5bb75bbd00e6172f2126ab8fff0e35c45275074109b29c809826a541c4.dll
- Size 236KB
- Sample240726-bs12ds1akf
- SHA256 0a659d5bb75bbd00e6172f2126ab8fff0e35c45275074109b29c809826a541c4
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
111
C2
-
52.73.70.149:443
-
8.4.9.152:3786
-
185.246.87.202:3098
-
50.116.111.64:5353
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a659d5bb75bbd00e6172f2126ab8fff0e35c45275074109b29c809826a541c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a659d5bb75bbd00e6172f2126ab8fff0e35c45275074109b29c809826a541c4.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2800-1-0x0000000000EC0000-0x0000000000EC6000-memory.dmp
memory/2800-0-0x0000000075210000-0x000000007524D000-memory.dmp
memory/2800-2-0x0000000075210000-0x000000007524D000-memory.dmp