dridex | b679c04afcf77a79a8facd9a3667c962c852013141d19084dc1b03b2966c9293

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9db63e8511c93121e836756cc6d647b.dll
Size 188KB
Sample240314-22fd6abh64
SHA256 b679c04afcf77a79a8facd9a3667c962c852013141d19084dc1b03b2966c9293
MD5 c9db63e8511c93121e836756cc6d647b
SHA1 91b0569a49948b1942c444b45f2027cfc22cbf2f
SHA512 2739c280047b92febd97591a021381d77f718b30d5b4cb5511515bf31648a50332b6a1285722c3359a610b53a42a07c1a4f19fa51cf8cb4cde1dda4ebe0b5b7e
SSDEEP 3072:yA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoCo:yzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/2964-0-0x0000000075450000-0x0000000075480000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	2964	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2964	1312	rundll32.exe	96
PID 1312 wrote to memory of 2964	1312	rundll32.exe	96
PID 1312 wrote to memory of 2964	1312	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9db63e8511c93121e836756cc6d647b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9db63e8511c93121e836756cc6d647b.dll,#1
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 688
    3⤵
    - Program crash
    PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2964 -ip 2964
1⤵
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000075450000-0x0000000075480000-memory.dmp

Download

memory/2964-2-0x0000000000DD0000-0x0000000000DD6000-memory.dmp