Analysis

  • max time kernel
    45s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-08-2024 00:17

General

  • Target

    c95131572adc4115f3ecbe21f537afa0N.dll

  • Size

    188KB

  • MD5

    c95131572adc4115f3ecbe21f537afa0

  • SHA1

    da0cf956f67aed2eabee6d32db828ea5c8ce6cd8

  • SHA256

    715b0799c3db5307a402611daafd191baabd2ba9d580f086fe42e20e5fed8e7c

  • SHA512

    ec1a366d2354e989f1be26da602d79c7b1d5aa4e18e41ba2258eebbb37e2fe927f61e89516f99b3c107b76d0a209a721baba0f548035842ad12282eb78823b6d

  • SSDEEP

    3072:aVQvaAHkST6gWMlS5bGoU7jAgjP4M1/cc7PbTp1CV9nEwivYUcRoYt:aVQCAESHWMObGsM1l7XTqnxZf

Malware Config

Extracted

Family

dridex

Botnet

111

C2

213.202.229.72:3074

85.25.144.36:4643

202.91.8.121:4643

107.175.87.150:3889

rc4.plain
1
ZrYStQjni0SnjOoAqadlvf5oSV4E7VPT7b0
rc4.plain
1
O2ePtMSy8y8vFgVl5Jtx121zBQiHcXCrk00cqBaMNaB7K2eFIUvO6hF53KncMXniNrayqgi

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95131572adc4115f3ecbe21f537afa0N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c95131572adc4115f3ecbe21f537afa0N.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3052-0-0x00000000748E0000-0x0000000074911000-memory.dmp

    Filesize

    196KB

  • memory/3052-2-0x0000000000130000-0x0000000000136000-memory.dmp

    Filesize

    24KB

  • memory/3052-3-0x00000000748E0000-0x0000000074911000-memory.dmp

    Filesize

    196KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.