dridex | 8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3.dll
Size

468KB
MD5

7cd23d8209f040ad6536ac558fa7ae89
SHA1

07f2bf5697e9b248d8976a0ffd238674a43380bd
SHA256

8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3
SHA512

7157ad3aea43054e148531b6cbd2a0f01c68aa85958be8105d8e1a2452d296a7429ccb037efc88d8a55bac92d6d8c87bda5331e0e921406a6399046fc771e61a
SSDEEP

6144:n0610FnNqVnt0Rt1CVlp0R5aMSw8EekUXnAwd37izAQqK/o2B6LjiReYiL3EU:06MSw8EekuB37izvjI/gU

Score

10^/10

dridex 22206 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22206

120.50.40.185:443

139.59.14.223:8172

121.40.104.209:6602

139.162.113.169:593

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/5008-1-0x0000000075670000-0x00000000756E6000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	5008	WerFault.exe	55

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 5008	1060	rundll32.exe	55
PID 1060 wrote to memory of 5008	1060	rundll32.exe	55
PID 1060 wrote to memory of 5008	1060	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8179bc64652d44d11b75f64430faa3bf9ebb6a4086af14ee4018b8bf36e685a3.dll,#1
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 644
    3⤵
    - Program crash
    PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5008 -ip 5008
1⤵
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-0-0x0000000000B90000-0x0000000000B96000-memory.dmp

Filesize
24KB

Download
memory/5008-1-0x0000000075670000-0x00000000756E6000-memory.dmp

Filesize
472KB

Download