dridex | bc24bb5ffbcf6032c928de2ca7d18fe580bb390f76b26bb7a8b083b8727446db

Analysis

max time kernel
19s
max time network
124s
platform
windows10_x64
resource
win10v20210410
submitted
11-06-2021 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc24bb5ffbcf6032c928de2ca7d18fe580bb390f76b26bb7a8b083b8727446db.dll
Size

174KB
MD5

1da31712d2601c187e60390479248c10
SHA1

9a5d7d14279ffa9597a1e589aa1c16173f55fb0e
SHA256

bc24bb5ffbcf6032c928de2ca7d18fe580bb390f76b26bb7a8b083b8727446db
SHA512

bc011eb382a3ad79483b7d60153ecfab0a7d0f5090f26bd5ae598a8951a52163ad0717ce11306374a0e0571a710fdc0a3e5924e931fdc5eec2bc6ca5e7c5ce3b

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

178.128.220.64:30333

45.79.91.89:9987

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/3264-115-0x0000000073A10000-0x0000000073A40000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1420 3264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1420	3264	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe
1420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1420 WerFault.exe
Token: SeBackupPrivilege 1420 WerFault.exe
Token: SeDebugPrivilege 1420 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1420	WerFault.exe
Token: SeBackupPrivilege	1420	WerFault.exe
Token: SeDebugPrivilege	1420	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3892 wrote to memory of 3264	3892	rundll32.exe	rundll32.exe
PID 3892 wrote to memory of 3264	3892	rundll32.exe	rundll32.exe
PID 3892 wrote to memory of 3264	3892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc24bb5ffbcf6032c928de2ca7d18fe580bb390f76b26bb7a8b083b8727446db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc24bb5ffbcf6032c928de2ca7d18fe580bb390f76b26bb7a8b083b8727446db.dll,#1
2⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 644
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3264-114-0x0000000000000000-mapping.dmp

Download
memory/3264-115-0x0000000073A10000-0x0000000073A40000-memory.dmp

Filesize
192KB

Download
memory/3264-117-0x0000000000470000-0x00000000005BA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads