dridex | cb8d0fa3f3a6bb6ab3a6fedcd3e357dbefb5bdd0f71f529f7ac92d4b34cfa721

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be916e6c11e32d8b2b6ff33f6ae91593.dll
Size 184KB
Sample240310-pafvdscf4s
SHA256 cb8d0fa3f3a6bb6ab3a6fedcd3e357dbefb5bdd0f71f529f7ac92d4b34cfa721
MD5 be916e6c11e32d8b2b6ff33f6ae91593
SHA1 942f1904f3570d6ff7bd95e43b88e1cdbfe74ee8
SHA512 012689ad7eba78e10506cc188adcf7e523cea05a642417ff2d65919ebe3cf3bb3b2af31d5baab4dd53429242ced1dce8d1d53cf945bda9a7cb9ddfe5b0f0926c
SSDEEP 3072:+hd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JTVQcY:+3fOeIv54W6SFKfc9me9v9/JTV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

51.79.50.122:443
222.124.142.67:10443
138.201.222.158:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/4424-0-0x0000000075840000-0x0000000075870000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	4424	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4424	1140	rundll32.exe	89
PID 1140 wrote to memory of 4424	1140	rundll32.exe	89
PID 1140 wrote to memory of 4424	1140	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be916e6c11e32d8b2b6ff33f6ae91593.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be916e6c11e32d8b2b6ff33f6ae91593.dll,#1
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 668
    3⤵
    - Program crash
    PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4424 -ip 4424
1⤵
PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-0-0x0000000075840000-0x0000000075870000-memory.dmp

Download

memory/4424-1-0x0000000000F90000-0x0000000000F96000-memory.dmp