dridex | e74390d1fa86529d668f01e7a0b48597e7c641f55c36f9fcb4021da1e9235bc8

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f458c6c1ba3f319ee7f688fbc1e9a63.dll
Size

188KB
MD5

7f458c6c1ba3f319ee7f688fbc1e9a63
SHA1

c13f506d3076360fabec1030d2f1a7dd1bc4abef
SHA256

e74390d1fa86529d668f01e7a0b48597e7c641f55c36f9fcb4021da1e9235bc8
SHA512

f6f58a878c96bdda91c4480d1423d8e9b7b25d2447a4a35684120a9def15b7a93c8a8fd4fe173e5533ee909bb09fb6fc2f9e6ed4c3e9ea485d5584fdbf87c312
SSDEEP

3072:UH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWZ7dU:UUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/376-1-0x0000000074DF0000-0x0000000074E20000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	376	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 376	2572	rundll32.exe	84
PID 2572 wrote to memory of 376	2572	rundll32.exe	84
PID 2572 wrote to memory of 376	2572	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f458c6c1ba3f319ee7f688fbc1e9a63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f458c6c1ba3f319ee7f688fbc1e9a63.dll,#1
  2⤵
  PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 692
    3⤵
    - Program crash
    PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 376 -ip 376
1⤵
PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-0-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Filesize
24KB

Download
memory/376-1-0x0000000074DF0000-0x0000000074E20000-memory.dmp

Filesize
192KB

Download
memory/376-3-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Filesize
24KB

Download