dridex | 482451c4462a2e1ca46cb7912ba06da3b0bfd74b1dae1a415fb0d72b87510fc4

Analysis

max time kernel
148s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

506c936822ff89ed12bcdb6510b6c894.dll
Size

188KB
MD5

506c936822ff89ed12bcdb6510b6c894
SHA1

c54162fcbd70b0ddc451568a2e2ba3a4c2fd767f
SHA256

482451c4462a2e1ca46cb7912ba06da3b0bfd74b1dae1a415fb0d72b87510fc4
SHA512

731825f4c887d7b9e018858a7595231905fb308b52873d66a3660da92e5abc6277c7621249a0e8643cb94615a00eb3cf8689adeb430183c4233261f1c577fe8e
SSDEEP

3072:pA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoco:pzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3276-1-0x0000000074BB0000-0x0000000074BE0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	3276	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3276	3440	rundll32.exe	89
PID 3440 wrote to memory of 3276	3440	rundll32.exe	89
PID 3440 wrote to memory of 3276	3440	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\506c936822ff89ed12bcdb6510b6c894.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\506c936822ff89ed12bcdb6510b6c894.dll,#1
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 688
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3276 -ip 3276
1⤵
PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-0-0x00000000014C0000-0x00000000014C6000-memory.dmp

Filesize
24KB

Download
memory/3276-1-0x0000000074BB0000-0x0000000074BE0000-memory.dmp

Filesize
192KB

Download
memory/3276-4-0x00000000014C0000-0x00000000014C6000-memory.dmp

Filesize
24KB

Download