dridex | 6e295b6615f75a85bb27564371f6a188d5583676ea017658759f2e212a39dc66

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70d0b5607ede423c96004d4344a8a3bd.dll
Size

188KB
MD5

70d0b5607ede423c96004d4344a8a3bd
SHA1

a1bb4e6f40af378f32776335ec5ab86ee88002c1
SHA256

6e295b6615f75a85bb27564371f6a188d5583676ea017658759f2e212a39dc66
SHA512

898050ead12816532bed5847f825085e14911ad0f836a90bcc9f8791576d7d068dbc5b29dc74e3bf587f7888e99d9cdf6c13913c37cee0db33bda961cd402e98
SSDEEP

3072:tA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoKo:tzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/8-0-0x0000000075480000-0x00000000754B0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	8	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 8	2304	rundll32.exe	85
PID 2304 wrote to memory of 8	2304	rundll32.exe	85
PID 2304 wrote to memory of 8	2304	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70d0b5607ede423c96004d4344a8a3bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70d0b5607ede423c96004d4344a8a3bd.dll,#1
  2⤵
  PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 692
    3⤵
    - Program crash
    PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8 -ip 8
1⤵
PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-0-0x0000000075480000-0x00000000754B0000-memory.dmp

Filesize
192KB

Download
memory/8-1-0x0000000000F00000-0x0000000000F06000-memory.dmp

Filesize
24KB

Download