Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
17/01/2024, 01:15
General
- Target 615bdcc7c8ff6a84c77e4d89f53f2885.dll
- Size 188KB
- Sample240117-bl7wcsfaa9
- SHA256 5b3d23746fd7cba61357ce09e0967140ed3c191693c5427018f0d13dc3fc2205
Malware Config
Extracted
-
dridex
-
22201
-
103.82.248.59:443
-
54.39.98.141:6602
-
103.109.247.8:10443
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\615bdcc7c8ff6a84c77e4d89f53f2885.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\615bdcc7c8ff6a84c77e4d89f53f2885.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 7003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4040 -ip 40401⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2172-4-0x00000232B5640000-0x00000232B5650000-memory.dmp
memory/2172-20-0x00000232B5740000-0x00000232B5750000-memory.dmp
memory/2172-36-0x00000232BDA30000-0x00000232BDA31000-memory.dmp
memory/2172-38-0x00000232BDA60000-0x00000232BDA61000-memory.dmp
memory/2172-39-0x00000232BDA60000-0x00000232BDA61000-memory.dmp
memory/2172-40-0x00000232BDB70000-0x00000232BDB71000-memory.dmp
memory/4040-0-0x0000000002590000-0x0000000002596000-memory.dmp
memory/4040-1-0x0000000075700000-0x0000000075730000-memory.dmp
memory/4040-3-0x0000000002590000-0x0000000002596000-memory.dmp