dridex | 6917ea044fd1bde296850d5593f9bbc920064698caeffafee35fc0d49417a7a0

Analysis

max time kernel
222s
max time network
47s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72bf78f351424a147b7dbcbf09335f6c.dll
Size

184KB
MD5

72bf78f351424a147b7dbcbf09335f6c
SHA1

cdc5d11ada6692f0441bdd0b4bee6ec7c9a0e569
SHA256

6917ea044fd1bde296850d5593f9bbc920064698caeffafee35fc0d49417a7a0
SHA512

c7299a01af5164bcdcab72328a5b622eaf8ae78c68d97aefae7e55035a8857aa6b03f23e829cfafbda39051d0cb4170a2cea119dc1da00d78b4cde0b7b6dea09
SSDEEP

3072:XgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdg7dA4l:SPFkq6zOe5ilSanOMd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.75.201.2:443

158.223.1.108:6225

165.22.28.242:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/2904-0-0x0000000074AD0000-0x0000000074B00000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	2904	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2204 wrote to memory of 2904	2204	rundll32.exe	27
PID 2904 wrote to memory of 1624	2904	rundll32.exe	28
PID 2904 wrote to memory of 1624	2904	rundll32.exe	28
PID 2904 wrote to memory of 1624	2904	rundll32.exe	28
PID 2904 wrote to memory of 1624	2904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72bf78f351424a147b7dbcbf09335f6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72bf78f351424a147b7dbcbf09335f6c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 224
    3⤵
    - Program crash
    PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-0-0x0000000074AD0000-0x0000000074B00000-memory.dmp

Filesize
192KB

Download
memory/2904-1-0x0000000000180000-0x0000000000186000-memory.dmp

Filesize
24KB

Download