dridex | 0e16f533d18ae86ab8cadc43a44e9ff7fd6586658939b6c60d6ed9201c31f33a

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:46

Target

s7yzrmv13.dll
Size

476KB
MD5

b9df50a14d692e7aac5cf697462379f0
SHA1

0ac013a74fa5f75313774fb1c5294a4e0b9a3a75
SHA256

0e16f533d18ae86ab8cadc43a44e9ff7fd6586658939b6c60d6ed9201c31f33a
SHA512

eeb54214a759e8daef83d0197495b6985db5f37a5a6d8ba3ab941157ded0c149eb6ae3ee930fe7ec5fd22aaee009d0a33c419a9557d4db53c1077c10cb070a9b
SSDEEP

12288:e7fimEsIsmY4K08oM1Wd8t5KQhNdv5z2:e7aVRBn7x6jtU

Score

10^/10

Family

dridex

Botnet

10444

23.246.204.126:443

151.106.39.36:8116

103.124.144.123:6891

172.105.78.60:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1396-133-0x0000000075260000-0x00000000752D9000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3076 1396 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3076	1396	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5084 wrote to memory of 1396	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 1396	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 1396	5084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s7yzrmv13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s7yzrmv13.dll,#1
2⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 700
3⤵
- Program crash
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1396 -ip 1396
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2172

memory/1396-133-0x0000000075260000-0x00000000752D9000-memory.dmp

Filesize
484KB

Download
memory/1396-134-0x00000000011A0000-0x00000000011A6000-memory.dmp

Filesize
24KB

Download