dridex | 0459ffa89fd4c07f07c48093c93db7762b1b6f85b355d645b4166b211de456b8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 18:49

Target

0459ffa89fd4c07f07c48093c93db7762b1b6f85b355d645b4166b211de456b8.dll
Size

184KB
MD5

84c4ac098bfda384d3f74c4b21c4d882
SHA1

073b64ea3ef2bfd504ce7f8fd832dfde608f1f2b
SHA256

0459ffa89fd4c07f07c48093c93db7762b1b6f85b355d645b4166b211de456b8
SHA512

876218fdbacb74900d25f6f3c5855e21d5947ee8fe5ccd5b59e175e94352c85ab2b4906aa26f01336b35d083a35fe38c538d302963e85007fdfa63e5ec9d92fc
SSDEEP

3072:HJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8Jta//2uFrSc:0fYOX+wTScR/Xzku9LVwquG

Score

10^/10

Family

dridex

Botnet

22201

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/2888-0-0x0000000074C00000-0x0000000074C2F000-memory.dmp	dridex_ldr
behavioral1/memory/2888-1-0x0000000074C00000-0x0000000074C2F000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2716 2888 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2716	2888	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1536 wrote to memory of 2888	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 2888	1536	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 2888	1536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0459ffa89fd4c07f07c48093c93db7762b1b6f85b355d645b4166b211de456b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0459ffa89fd4c07f07c48093c93db7762b1b6f85b355d645b4166b211de456b8.dll,#1
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 616
    3⤵
    - Program crash
    PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2888 -ip 2888
1⤵
PID:4480

memory/2888-0-0x0000000074C00000-0x0000000074C2F000-memory.dmp

Filesize
188KB

Download
memory/2888-2-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/2888-1-0x0000000074C00000-0x0000000074C2F000-memory.dmp

Filesize
188KB

Download