Breaking Dridex Malware
summary
Analysis unpacks Dridex loaders (often custom-packed in memory) by monitoring VirtualProtect/VirtualAlloc or using tools like Immunity Debugger and Hollow’s Hunter, extracts RC4 with 40‑byte key encrypted strings from .rdata, locates C2 lists stored as byte blobs, and decodes commands that use CRC32 command hashing. A Python Dridex Analysis Toolkit on GitHub automates dumping, RC4 decryption and C2 extraction; a 9d script annotates resolved APIs. A practical vaccine uses CRC32 collisions to plant a spoof DLL in the csvo64 directory that aborts the process when loaded.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:55Presentations Agenda
- 2:42Dridex Loader
- 3:09Unpack the File
- 4:59C2 Communication
- 7:51The Drydex Analysis Toolkit
- 9:24Dynamic Api Call Resolution
- 10:30Process Environment Block
- 13:13What Happens When a Dll Is Not Found in the Process Environment Block
- 18:54References
related talks
33mBasic Malware Analysis for Incident Responders
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
25mCommSec D1 - A Deep Dive Into Malicious Documents
29mRendering Ransomware Detection and EDR Products Blind
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
38mCracking a ransomware family
39mREDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It