dridex | 5f61fda19a8466fd766935536aa5637b032fc4bd6eaa8dc691c13d844739d692

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc6466475da60e5e7b4f252ab533b181.dll
Size

188KB
MD5

cc6466475da60e5e7b4f252ab533b181
SHA1

7c6de9b817d7cc20716d54ad0bcce8e528fc42c3
SHA256

5f61fda19a8466fd766935536aa5637b032fc4bd6eaa8dc691c13d844739d692
SHA512

cf66bde2d20b4f4fc02d0f4075d7f493e407fa8aaa8a8464e4a6d15a42d512ab17ea5ed8858721219944002f8762db3eec1853e08f62a2cf9843636f8ebaee7c
SSDEEP

3072:uA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoEo:uzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/4600-0-0x0000000074910000-0x0000000074940000-memory.dmp	dridex_ldr
behavioral2/memory/4600-2-0x0000000074910000-0x0000000074940000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	4600	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4600	3880	rundll32.exe	83
PID 3880 wrote to memory of 4600	3880	rundll32.exe	83
PID 3880 wrote to memory of 4600	3880	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc6466475da60e5e7b4f252ab533b181.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc6466475da60e5e7b4f252ab533b181.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 688
    3⤵
    - Program crash
    PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4600 -ip 4600
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4600-0-0x0000000074910000-0x0000000074940000-memory.dmp

Filesize
192KB

Download
memory/4600-1-0x0000000000EB0000-0x0000000000EB6000-memory.dmp

Filesize
24KB

Download
memory/4600-2-0x0000000074910000-0x0000000074940000-memory.dmp

Filesize
192KB

Download