dridex | 8f2bb2ad978eca35cff9bd456ea9d7566faae51d7c31645497cc85577da1c212

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3c40e2d881827c3482860565b6053ee.dll
Size 188KB
Sample240312-te919ada7y
SHA256 8f2bb2ad978eca35cff9bd456ea9d7566faae51d7c31645497cc85577da1c212
MD5 c3c40e2d881827c3482860565b6053ee
SHA1 e8bed57927c70fd58ea9c8292b57d2f817efc3bc
SHA512 25572f997c91057bf4102f68caf94ab30a7eeea6a04ccf13d46bfb29c94ac155529fe96f59a9817617c8d1c24318af79d3b7816aeee23d1f02ca87ec28f9ea74
SSDEEP 3072:AH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWt7dU:AUua/Pv7YNhRIEZDeXVpAxtMsxK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3192-1-0x0000000074A20000-0x0000000074A50000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	3192	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3192	3300	rundll32.exe	87
PID 3300 wrote to memory of 3192	3300	rundll32.exe	87
PID 3300 wrote to memory of 3192	3300	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c40e2d881827c3482860565b6053ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c40e2d881827c3482860565b6053ee.dll,#1
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 692
    3⤵
    - Program crash
    PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3192 -ip 3192
1⤵
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3192-0-0x0000000001F90000-0x0000000001F96000-memory.dmp

Download

memory/3192-1-0x0000000074A20000-0x0000000074A50000-memory.dmp

Download

memory/3192-3-0x0000000001F90000-0x0000000001F96000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads