dridex | 62b68f5d92392ecfe5ab2a10cbe13dd406fa728840e3aab76b7602b71d28e538

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b35164c22aa68fe0c30ef09532f315e8.dll
Size 188KB
Sample240304-2zkabsha23
SHA256 62b68f5d92392ecfe5ab2a10cbe13dd406fa728840e3aab76b7602b71d28e538
MD5 b35164c22aa68fe0c30ef09532f315e8
SHA1 3fde48fe078921fb2a845c0c8fd7e99b4c848949
SHA512 97861d1b0d93b0801dae0e41998befc17da9d436415809aeb29c8ee47db2e0f231eba2d14d29af3b4da60f413b05c4c5210d6137e5afd6685f47fbce4e522ad7
SSDEEP 3072:8A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAooo:8zIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3532-1-0x0000000075280000-0x00000000752B0000-memory.dmp	dridex_ldr
behavioral2/memory/3532-2-0x0000000075280000-0x00000000752B0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3568	3532	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3532	1640	rundll32.exe	88
PID 1640 wrote to memory of 3532	1640	rundll32.exe	88
PID 1640 wrote to memory of 3532	1640	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35164c22aa68fe0c30ef09532f315e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b35164c22aa68fe0c30ef09532f315e8.dll,#1
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 688
    3⤵
    - Program crash
    PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3532 -ip 3532
1⤵
PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-1-0x0000000075280000-0x00000000752B0000-memory.dmp

Download

memory/3532-0-0x0000000000C50000-0x0000000000C56000-memory.dmp

Download

memory/3532-2-0x0000000075280000-0x00000000752B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads