dridex | 4c72d3e445bf8696e7deb9ac95d7c10183e4bbc8e5dbbb4681f94e65dd9620d6

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd309fc15771732b89eb65c0e9c43ec7.dll
Size 188KB
Sample240310-ap826afe71
SHA256 4c72d3e445bf8696e7deb9ac95d7c10183e4bbc8e5dbbb4681f94e65dd9620d6
MD5 bd309fc15771732b89eb65c0e9c43ec7
SHA1 7c3837253da961791cd2d1007f8b3ecba393272d
SHA512 c21a79da34ae18c9aa159a3dae1b32e8e2dab3db3cefaeb2e14fe71c2eebfd47ed883c71e21542f4e74c913c008226547249814c0467a74b8fad03c7162cad47
SSDEEP 3072:KA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:KzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/4908-1-0x00000000755A0000-0x00000000755D0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	4908	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 4908	792	rundll32.exe	94
PID 792 wrote to memory of 4908	792	rundll32.exe	94
PID 792 wrote to memory of 4908	792	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd309fc15771732b89eb65c0e9c43ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd309fc15771732b89eb65c0e9c43ec7.dll,#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 656
    3⤵
    - Program crash
    PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4908 -ip 4908
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-0-0x00000000010F0000-0x00000000010F6000-memory.dmp

Download

memory/4908-1-0x00000000755A0000-0x00000000755D0000-memory.dmp

Download

memory/4908-4-0x00000000010F0000-0x00000000010F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads