dridex | edab7c43f27e58e898ecfa5e10cc600f459e89996fa6a5b87901f67fcb4ace8a

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741155854786e7c4184a20f7f58cc34e.dll
Size

184KB
MD5

741155854786e7c4184a20f7f58cc34e
SHA1

2ef218a4a8b622a49b747b8c29cf8ac7fe28bb6f
SHA256

edab7c43f27e58e898ecfa5e10cc600f459e89996fa6a5b87901f67fcb4ace8a
SHA512

0ad4afe3cf592cbd8e711e29ede83d34ee4596d38192e88d50b05fdf1a10bfdaa7eddf650ee70cb38797d88b1d92839a8a4c242810597c9922b7dc9652fed02f
SSDEEP

3072:LgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdgjdA4l:OPFkq6zOe5ilSanOYd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.75.201.2:443

158.223.1.108:6225

165.22.28.242:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1420-0-0x0000000074B20000-0x0000000074B50000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1420	WerFault.exe	15

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 2108 wrote to memory of 1420	2108	rundll32.exe	15
PID 1420 wrote to memory of 1708	1420	rundll32.exe	29
PID 1420 wrote to memory of 1708	1420	rundll32.exe	29
PID 1420 wrote to memory of 1708	1420	rundll32.exe	29
PID 1420 wrote to memory of 1708	1420	rundll32.exe	29

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\741155854786e7c4184a20f7f58cc34e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 220
  2⤵
  - Program crash
  PID:1708

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\741155854786e7c4184a20f7f58cc34e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-0-0x0000000074B20000-0x0000000074B50000-memory.dmp

Filesize
192KB

Download
memory/1420-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download