dridex | 2ebcadadf502dd6cc67ba293426b54442d2484ea4e4e4b5d10aac7b227855394

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bce662010e5f2bbfb1f505cceee3e5d2.dll
Size 188KB
Sample240309-1spe2acc3z
SHA256 2ebcadadf502dd6cc67ba293426b54442d2484ea4e4e4b5d10aac7b227855394
MD5 bce662010e5f2bbfb1f505cceee3e5d2
SHA1 ae3c1b7ddae72be39bafee2fe4780a75d63e0a0f
SHA512 69494dfbabd188895f1bf87f20e0f71e05c7067e05b20ac29e1d30f393210f31165a18d60d1a4af293b803aafcdfa508439575ae5c12cc2fec89489dc34fe13f
SSDEEP 3072:cA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAovo:czIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/1360-0-0x0000000075680000-0x00000000756B0000-memory.dmp	dridex_ldr
behavioral2/memory/1360-2-0x0000000075680000-0x00000000756B0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1360	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1360	3236	rundll32.exe	89
PID 3236 wrote to memory of 1360	3236	rundll32.exe	89
PID 3236 wrote to memory of 1360	3236	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bce662010e5f2bbfb1f505cceee3e5d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bce662010e5f2bbfb1f505cceee3e5d2.dll,#1
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 688
    3⤵
    - Program crash
    PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1360 -ip 1360
1⤵
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-0-0x0000000075680000-0x00000000756B0000-memory.dmp

Download

memory/1360-1-0x00000000013A0000-0x00000000013A6000-memory.dmp

Download

memory/1360-2-0x0000000075680000-0x00000000756B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads