dridex | 00eaecaace4a0b24b231cffd833a34f1e323768b517140ea1810aca892596bfa

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb9f2f94f6f8f035c9923052e6da661a.dll
Size 188KB
Sample240308-s2hpvabe4x
SHA256 00eaecaace4a0b24b231cffd833a34f1e323768b517140ea1810aca892596bfa
MD5 bb9f2f94f6f8f035c9923052e6da661a
SHA1 5a27c6f7f7759a47c01b7720a130085a116ae11d
SHA512 55984f0ba4e4793edab2bb579f4b15c8330286df1fadcf0798421de68d60b22b83a78ccba8d9a3d0d3b8818b68ad0c570358a9291af63aab247660ab3a266bc4
SSDEEP 3072:fA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoro:fzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/1832-1-0x00000000757B0000-0x00000000757E0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	1832	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1832	3032	rundll32.exe	87
PID 3032 wrote to memory of 1832	3032	rundll32.exe	87
PID 3032 wrote to memory of 1832	3032	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9f2f94f6f8f035c9923052e6da661a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9f2f94f6f8f035c9923052e6da661a.dll,#1
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 688
    3⤵
    - Program crash
    PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1832 -ip 1832
1⤵
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-0-0x0000000000B40000-0x0000000000B46000-memory.dmp

Download

memory/1832-1-0x00000000757B0000-0x00000000757E0000-memory.dmp