dridex | b738900e90cc0b4d743a14570bab52cec9c9a3e1631de7c6773af7e3a846e946

Analysis

max time kernel
144s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 18:54

Target

b738900e90cc0b4d743a14570bab52cec9c9a3e1631de7c6773af7e3a846e946.dll
Size

184KB
MD5

cc6cc1910ab801f7e2064a434570fae9
SHA1

ed0254a72cdb09a7510b9151f2ad8b196010ad5c
SHA256

b738900e90cc0b4d743a14570bab52cec9c9a3e1631de7c6773af7e3a846e946
SHA512

ba17c2a09192bae5c646716cb4ba409800122329f054b954e4833163cf8107354976993103ca1a5ed24750c1ca0da220a0580d80270bbcd9e23bfd03f070408a
SSDEEP

3072:LJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8J8a//2uFrSc:QfYOX+wTScR/Xzku9LVwfuG

Score

10^/10

Family

dridex

Botnet

22201

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1244-0-0x0000000074F70000-0x0000000074F9F000-memory.dmp	dridex_ldr
behavioral2/memory/1244-2-0x0000000074F70000-0x0000000074F9F000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2780 1244 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2780	1244	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1540 wrote to memory of 1244	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1244	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1244	1540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b738900e90cc0b4d743a14570bab52cec9c9a3e1631de7c6773af7e3a846e946.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b738900e90cc0b4d743a14570bab52cec9c9a3e1631de7c6773af7e3a846e946.dll,#1
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 472
    3⤵
    - Program crash
    PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1244 -ip 1244
1⤵
PID:2420

memory/1244-0-0x0000000074F70000-0x0000000074F9F000-memory.dmp

Filesize
188KB

Download
memory/1244-1-0x0000000000E20000-0x0000000000E26000-memory.dmp

Filesize
24KB

Download
memory/1244-2-0x0000000074F70000-0x0000000074F9F000-memory.dmp

Filesize
188KB

Download