dridex | 081c53fcc75e6a039d18af6301d6592dd505ce1e4aeca01e3dc2227544408643

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae558e922b1f2b0d0cc7a7c9995e3645.dll
Size 184KB
Sample240229-mxrt3afb47
SHA256 081c53fcc75e6a039d18af6301d6592dd505ce1e4aeca01e3dc2227544408643
MD5 ae558e922b1f2b0d0cc7a7c9995e3645
SHA1 03b9a7de8225ccbe32ba45602f2c6e7140261c22
SHA512 9d627c00a40be6cadedfcd437a6d3ff2acddfb625d6b62e014b070bab1e06ade20e6aba2514b7bcbdd175a7bc841d10babb3231d7175482634281ba0fdedf3e4
SSDEEP 3072:mhd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JaVQcY:m3fOeIv54W6SFKfc9me9v9/JaV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

51.79.50.122:443
222.124.142.67:10443
138.201.222.158:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/5116-0-0x0000000074960000-0x0000000074990000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	5116	WerFault.exe	64

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 5116	744	rundll32.exe	64
PID 744 wrote to memory of 5116	744	rundll32.exe	64
PID 744 wrote to memory of 5116	744	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae558e922b1f2b0d0cc7a7c9995e3645.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae558e922b1f2b0d0cc7a7c9995e3645.dll,#1
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 668
    3⤵
    - Program crash
    PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5116 -ip 5116
1⤵
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5116-0-0x0000000074960000-0x0000000074990000-memory.dmp

Download

memory/5116-1-0x00000000001F0000-0x00000000001F6000-memory.dmp