dridex | 00eaecaace4a0b24b231cffd833a34f1e323768b517140ea1810aca892596bfa

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb9f2f94f6f8f035c9923052e6da661a.dll
Size 188KB
Sample240308-s2hpvabe4x
SHA256 00eaecaace4a0b24b231cffd833a34f1e323768b517140ea1810aca892596bfa
MD5 bb9f2f94f6f8f035c9923052e6da661a
SHA1 5a27c6f7f7759a47c01b7720a130085a116ae11d
SHA512 55984f0ba4e4793edab2bb579f4b15c8330286df1fadcf0798421de68d60b22b83a78ccba8d9a3d0d3b8818b68ad0c570358a9291af63aab247660ab3a266bc4
SSDEEP 3072:fA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoro:fzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/2120-1-0x0000000074BF0000-0x0000000074C20000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2120	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 1300 wrote to memory of 2120	1300	rundll32.exe	28
PID 2120 wrote to memory of 2948	2120	rundll32.exe	29
PID 2120 wrote to memory of 2948	2120	rundll32.exe	29
PID 2120 wrote to memory of 2948	2120	rundll32.exe	29
PID 2120 wrote to memory of 2948	2120	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9f2f94f6f8f035c9923052e6da661a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9f2f94f6f8f035c9923052e6da661a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 308
    3⤵
    - Program crash
    PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-0-0x00000000000C0000-0x00000000000C6000-memory.dmp

Download

memory/2120-1-0x0000000074BF0000-0x0000000074C20000-memory.dmp