dridex | 9ab1ab44561bc4a233a97bc3f0a409c84ccca1b8ec7550ca15b1f5f2f284ff98

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 06:33

Target

98b837285d4beba7ccc06d504fdbf4fa.dll
Size

184KB
MD5

98b837285d4beba7ccc06d504fdbf4fa
SHA1

720f5416be8902a88c14c9f8e2d5675eff266a74
SHA256

9ab1ab44561bc4a233a97bc3f0a409c84ccca1b8ec7550ca15b1f5f2f284ff98
SHA512

416432e15105023cc5901e82f3228c38a2567cb00f3910485c28f0f4f0e0af3f82456ca94da96bb518777ecb46cac8450c66b52e07fed4273a84e267072aea10
SSDEEP

3072:0pBt4RUnGdP8IEQXzCPzA6TkHZ2pClbpU9q3XpO9adx1Gyy8EG+pt5Ola0:0pj4anGdSu2b020lbpOApO9+x10lG+pk

Score

10^/10

Family

dridex

Botnet

22203

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1056-1-0x0000000074D40000-0x0000000074D70000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4268 1056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4268	1056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 756 wrote to memory of 1056	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1056	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1056	756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b837285d4beba7ccc06d504fdbf4fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b837285d4beba7ccc06d504fdbf4fa.dll,#1
2⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 668
3⤵
- Program crash
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1056 -ip 1056
1⤵
PID:5028

memory/1056-0-0x0000000001690000-0x0000000001696000-memory.dmp

Filesize
24KB

Download
memory/1056-1-0x0000000074D40000-0x0000000074D70000-memory.dmp

Filesize
192KB

Download
memory/1056-4-0x0000000001690000-0x0000000001696000-memory.dmp

Filesize
24KB

Download