dridex | 1c9371517c45041c3e79670f46b08fa4a175a3494af321e899e1d91f3994003a

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c279055206c56889aa2c0303f89ee1e1.dll
Size 188KB
Sample240312-fbtyzaae94
SHA256 1c9371517c45041c3e79670f46b08fa4a175a3494af321e899e1d91f3994003a
MD5 c279055206c56889aa2c0303f89ee1e1
SHA1 658d4be220e44d2eb4f9357d6d526f07f20d4b00
SHA512 326ac378662ac60deb48cf43f3cb017f1de947040d188b5d9a3c179c71d8dfd0124d344c1fa5b57cd64446c2cb0a4b2a3956fd2f8af2a62b6558a2a4f14e2a86
SSDEEP 3072:zA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoGo:zzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3196-0-0x0000000074F30000-0x0000000074F60000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	3196	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3196	4900	rundll32.exe	84
PID 4900 wrote to memory of 3196	4900	rundll32.exe	84
PID 4900 wrote to memory of 3196	4900	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c279055206c56889aa2c0303f89ee1e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c279055206c56889aa2c0303f89ee1e1.dll,#1
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 692
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3196 -ip 3196
1⤵
PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-0-0x0000000074F30000-0x0000000074F60000-memory.dmp

Download

memory/3196-1-0x0000000001060000-0x0000000001066000-memory.dmp