dridex | 6c51bb51194714e648ca6481f238776052ecb3dc3d08bb5b9392ccada6aeaf70

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcedbffafa86eea22129359f79b097b0.dll
Size 188KB
Sample240309-132hcacb73
SHA256 6c51bb51194714e648ca6481f238776052ecb3dc3d08bb5b9392ccada6aeaf70
MD5 bcedbffafa86eea22129359f79b097b0
SHA1 f936189e9c20a99c4bc82c7d62583332e6e68603
SHA512 531e3cce521a85613cee4effc8bf22b6b7903c1c2ede43d7e0a5a2c8c76bc76742862f39675beed3c59ceea63fd8cc3dc894d7c7b8d53662383daf17130f874a
SSDEEP 3072:jA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoAo:jzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/4744-0-0x0000000075410000-0x0000000075440000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	4744	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4744	4644	rundll32.exe	89
PID 4644 wrote to memory of 4744	4644	rundll32.exe	89
PID 4644 wrote to memory of 4744	4644	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcedbffafa86eea22129359f79b097b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcedbffafa86eea22129359f79b097b0.dll,#1
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 688
    3⤵
    - Program crash
    PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4744 -ip 4744
1⤵
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-0-0x0000000075410000-0x0000000075440000-memory.dmp

Download

memory/4744-2-0x0000000000C20000-0x0000000000C26000-memory.dmp