dridex | fc84494eb2a80cc8f493235200b73ae24e2e39dd5cc5cd5139665b51f0e6edff

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc2914de4b1bb69e743eb0ec4991f5e6.dll
Size

188KB
MD5

cc2914de4b1bb69e743eb0ec4991f5e6
SHA1

0c5760474ee0f449793f42c8a3d946e30c7ede41
SHA256

fc84494eb2a80cc8f493235200b73ae24e2e39dd5cc5cd5139665b51f0e6edff
SHA512

e0f1dcfa9728c0b1a4fa51042e5f51afa810283ad667a00b77f21ff7f4c887da412b65a4a6497a3ce50c761d637faa266b1e6bf9521797fc03c6502f11595fca
SSDEEP

3072:yH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWw7dU:yUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/116-1-0x0000000075430000-0x0000000075460000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	116	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 116	620	rundll32.exe	94
PID 620 wrote to memory of 116	620	rundll32.exe	94
PID 620 wrote to memory of 116	620	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2914de4b1bb69e743eb0ec4991f5e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2914de4b1bb69e743eb0ec4991f5e6.dll,#1
  2⤵
  PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 664
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 116 -ip 116
1⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-0-0x0000000000D90000-0x0000000000D96000-memory.dmp

Filesize
24KB

Download
memory/116-1-0x0000000075430000-0x0000000075460000-memory.dmp

Filesize
192KB

Download
memory/116-4-0x0000000000D90000-0x0000000000D96000-memory.dmp

Filesize
24KB

Download