dridex | ecb335163a7d8db8d6d826d0d655378883465fbae055142d4cdbe54fb7c14544

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a112f74e73f9420896e48bef3a4dbef1.dll
Size

188KB
MD5

a112f74e73f9420896e48bef3a4dbef1
SHA1

5bf8e719c4182c888b96c59ad7d6b80d2daee4df
SHA256

ecb335163a7d8db8d6d826d0d655378883465fbae055142d4cdbe54fb7c14544
SHA512

24332f924afb77a62ab3364e978779ab1c8a878b986133143e57402086a6eda58af32cccca0393ddd17743626bd82bc34df11b5aacbb455d697abf7b1e3955b9
SSDEEP

3072:SA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:SzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/4044-0-0x0000000074DB0000-0x0000000074DE0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3876	4044	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4044	2984	rundll32.exe	76
PID 2984 wrote to memory of 4044	2984	rundll32.exe	76
PID 2984 wrote to memory of 4044	2984	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a112f74e73f9420896e48bef3a4dbef1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a112f74e73f9420896e48bef3a4dbef1.dll,#1
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 692
    3⤵
    - Program crash
    PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4044 -ip 4044
1⤵
PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-0-0x0000000074DB0000-0x0000000074DE0000-memory.dmp

Filesize
192KB

Download
memory/4044-1-0x00000000016D0000-0x00000000016D6000-memory.dmp

Filesize
24KB

Download