dridex | 0b32835f121d563857dc69b69ddfdd56dbd6ce93d7d6dce074891cf1c16e96e5

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55de3b55003ab92e521d25b55335ced4.dll
Size

175KB
MD5

55de3b55003ab92e521d25b55335ced4
SHA1

73a6f552cadc5fa9809ea6cd0c4e799aba74af66
SHA256

0b32835f121d563857dc69b69ddfdd56dbd6ce93d7d6dce074891cf1c16e96e5
SHA512

eed460ffcc0d57a9867dc43e872562c4cd5eb2ccd4eddc173b91241ee07c4575c8eb3c221868445a6072f3ba41b6cd1ece27847a40acc1c0c6dffb939a0db199
SSDEEP

3072:7CAOe6ths2hyT0DzJfN3ZKU3YkmN5Sw4Q2kUl59Pn9ZbAAW0f3:7CAOem/DzJhok45X4HP3b

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

46.55.222.10:443

104.248.178.90:4664

173.212.243.155:7002

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3256-0-0x0000000074E60000-0x0000000074E90000-memory.dmp	dridex_ldr
behavioral2/memory/3256-3-0x0000000074E60000-0x0000000074E90000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	3256	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3256	1344	rundll32.exe	16
PID 1344 wrote to memory of 3256	1344	rundll32.exe	16
PID 1344 wrote to memory of 3256	1344	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de3b55003ab92e521d25b55335ced4.dll,#1
1⤵
PID:3256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 612
  2⤵
  - Program crash
  PID:532

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55de3b55003ab92e521d25b55335ced4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3256 -ip 3256
1⤵
PID:440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3256-2-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/3256-0-0x0000000074E60000-0x0000000074E90000-memory.dmp

Filesize
192KB

Download
memory/3256-3-0x0000000074E60000-0x0000000074E90000-memory.dmp

Filesize
192KB

Download