dridex | d53c5cb13228f040a7d3040ae4b320c61861dab62c427fa060188ebb647dd08f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7d7514769ea4018099bf3c9ea3fb4c2.dll
Size

184KB
MD5

c7d7514769ea4018099bf3c9ea3fb4c2
SHA1

d8f2491caad039e64053cc145b632fbe4948fc6a
SHA256

d53c5cb13228f040a7d3040ae4b320c61861dab62c427fa060188ebb647dd08f
SHA512

1da9d4759673a34a498ab4b9e78e404ecbf931c03de48a80be21a81da30c65e33e8de01ba4f8cc8369bdc31d16e15e3cb20f5485d415a5ecd9664de76b967dca
SSDEEP

3072:Phd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33J+VQcY:P3fOeIv54W6SFKfc9me9v9/J+V

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/2188-0-0x00000000749D0000-0x0000000074A00000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2188	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 1108 wrote to memory of 2188	1108	rundll32.exe	28
PID 2188 wrote to memory of 2968	2188	rundll32.exe	29
PID 2188 wrote to memory of 2968	2188	rundll32.exe	29
PID 2188 wrote to memory of 2968	2188	rundll32.exe	29
PID 2188 wrote to memory of 2968	2188	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7d7514769ea4018099bf3c9ea3fb4c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7d7514769ea4018099bf3c9ea3fb4c2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 280
    3⤵
    - Program crash
    PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x00000000749D0000-0x0000000074A00000-memory.dmp

Filesize
192KB

Download
memory/2188-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download