dridex | 0b32835f121d563857dc69b69ddfdd56dbd6ce93d7d6dce074891cf1c16e96e5

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55de3b55003ab92e521d25b55335ced4.dll
Size

175KB
MD5

55de3b55003ab92e521d25b55335ced4
SHA1

73a6f552cadc5fa9809ea6cd0c4e799aba74af66
SHA256

0b32835f121d563857dc69b69ddfdd56dbd6ce93d7d6dce074891cf1c16e96e5
SHA512

eed460ffcc0d57a9867dc43e872562c4cd5eb2ccd4eddc173b91241ee07c4575c8eb3c221868445a6072f3ba41b6cd1ece27847a40acc1c0c6dffb939a0db199
SSDEEP

3072:7CAOe6ths2hyT0DzJfN3ZKU3YkmN5Sw4Q2kUl59Pn9ZbAAW0f3:7CAOem/DzJhok45X4HP3b

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

46.55.222.10:443

104.248.178.90:4664

173.212.243.155:7002

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1960-0-0x0000000074F50000-0x0000000074F80000-memory.dmp	dridex_ldr
behavioral1/memory/1960-2-0x0000000074F50000-0x0000000074F80000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	1960	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 2444 wrote to memory of 1960	2444	rundll32.exe	14
PID 1960 wrote to memory of 2076	1960	rundll32.exe	29
PID 1960 wrote to memory of 2076	1960	rundll32.exe	29
PID 1960 wrote to memory of 2076	1960	rundll32.exe	29
PID 1960 wrote to memory of 2076	1960	rundll32.exe	29

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de3b55003ab92e521d25b55335ced4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 220
  2⤵
  - Program crash
  PID:2076

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de3b55003ab92e521d25b55335ced4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-1-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/1960-0-0x0000000074F50000-0x0000000074F80000-memory.dmp

Filesize
192KB

Download
memory/1960-2-0x0000000074F50000-0x0000000074F80000-memory.dmp

Filesize
192KB

Download