dridex | e74390d1fa86529d668f01e7a0b48597e7c641f55c36f9fcb4021da1e9235bc8

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f458c6c1ba3f319ee7f688fbc1e9a63.dll
Size

188KB
MD5

7f458c6c1ba3f319ee7f688fbc1e9a63
SHA1

c13f506d3076360fabec1030d2f1a7dd1bc4abef
SHA256

e74390d1fa86529d668f01e7a0b48597e7c641f55c36f9fcb4021da1e9235bc8
SHA512

f6f58a878c96bdda91c4480d1423d8e9b7b25d2447a4a35684120a9def15b7a93c8a8fd4fe173e5533ee909bb09fb6fc2f9e6ed4c3e9ea485d5584fdbf87c312
SSDEEP

3072:UH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWZ7dU:UUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/2192-0-0x00000000750C0000-0x00000000750F0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2336 wrote to memory of 2192	2336	rundll32.exe	28
PID 2192 wrote to memory of 2884	2192	rundll32.exe	29
PID 2192 wrote to memory of 2884	2192	rundll32.exe	29
PID 2192 wrote to memory of 2884	2192	rundll32.exe	29
PID 2192 wrote to memory of 2884	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f458c6c1ba3f319ee7f688fbc1e9a63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f458c6c1ba3f319ee7f688fbc1e9a63.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 308
    3⤵
    - Program crash
    PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x00000000750C0000-0x00000000750F0000-memory.dmp

Filesize
192KB

Download
memory/2192-1-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download