dridex | e23d31709a59432ef6f12922fa79f4cdf387b8f0376291ddf78f604f2203f531

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af44604fba422d434a7947095e467b6e.dll
Size 188KB
Sample240229-xyp2zaae33
SHA256 e23d31709a59432ef6f12922fa79f4cdf387b8f0376291ddf78f604f2203f531
MD5 af44604fba422d434a7947095e467b6e
SHA1 e9aa3d999ea0cee17e1ffe9849326ce1b02c07a7
SHA512 3849cd217bd5defc7b44076a5ed4f7366e67c223679fd703e6f08b08d611bccae7b7e7378cc1f91b7727d72f330528b2ebe66c1b08b7b4b2229e6a7ebfc45d43
SSDEEP 3072:eA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAooo:ezIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3248-1-0x0000000074D20000-0x0000000074D50000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	3248	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3248	4420	rundll32.exe	94
PID 4420 wrote to memory of 3248	4420	rundll32.exe	94
PID 4420 wrote to memory of 3248	4420	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af44604fba422d434a7947095e467b6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af44604fba422d434a7947095e467b6e.dll,#1
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 692
    3⤵
    - Program crash
    PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3248 -ip 3248
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-1-0x0000000074D20000-0x0000000074D50000-memory.dmp

Download

memory/3248-2-0x0000000001420000-0x0000000001426000-memory.dmp