Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-03-2024 02:10

General

  • Target

    b0f65a63dd08f3977dc1bedaf30aaec5.dll

  • Size

    184KB

  • MD5

    b0f65a63dd08f3977dc1bedaf30aaec5

  • SHA1

    1d9428fe595de912eb087a568144a2e5e90fb545

  • SHA256

    84335aac46b5b746dbcace6e04e4d3af2e7f7bda72da361a6777091ad9dfc09f

  • SHA512

    634fd7189f848bdee1860567f319a9711cfdedb892b668bfa52f781e9483036af20a1de841bcad43dbe84e082d8fc606ef139ee0657054701e53f51de65692d1

  • SSDEEP

    3072:nqJs2vTNBtg6SSiP2uPGub071f8eWdwBIZ2qSeOVg2f0LhSLl8Vaci2+e2f2:nqbNfaScP47aeWdWqgj0LI86b

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

134.209.182.12:443

188.40.100.254:4664

103.109.247.9:10443

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0f65a63dd08f3977dc1bedaf30aaec5.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0f65a63dd08f3977dc1bedaf30aaec5.dll,#1
      2⤵
        PID:4348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 648
          3⤵
          • Program crash
          PID:972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4348 -ip 4348
      1⤵
        PID:2904
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2996

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4348-0-0x00000000011A0000-0x00000000011A6000-memory.dmp

          Filesize

          24KB

        • memory/4348-1-0x0000000075480000-0x00000000754AF000-memory.dmp

          Filesize

          188KB

        • memory/4348-3-0x00000000011A0000-0x00000000011A6000-memory.dmp

          Filesize

          24KB