dridex | 1ca879f26c57a057a9894ce1d0081b4d258cc490ab6f269e5efa12bb2ee6ba3c

Analysis

max time kernel
150s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 19:05

Target

d6e3605efb4ec3234178081248fd155c.dll
Size

188KB
MD5

d6e3605efb4ec3234178081248fd155c
SHA1

c5dff99198747a1ebd18228b4197f8d77a53a823
SHA256

1ca879f26c57a057a9894ce1d0081b4d258cc490ab6f269e5efa12bb2ee6ba3c
SHA512

9deb02f929b42ddeced1948348c2dc4e67cfbda7ba7a19e9789cda4782ffbad32c8d9a74f288e8a86d5125d0c3e4b298764617119b7e76d5ea6f4587ae850aa8
SSDEEP

3072:DH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWs7dU:DUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4648-1-0x00000000757E0000-0x0000000075810000-memory.dmp	dridex_ldr

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1424 4648 WerFault.exe rundll32.exe
3104 4648 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1424	4648	WerFault.exe	rundll32.exe
3104	4648	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2572 wrote to memory of 4648	2572	rundll32.exe	rundll32.exe
PID 2572 wrote to memory of 4648	2572	rundll32.exe	rundll32.exe
PID 2572 wrote to memory of 4648	2572	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 1424	4648	rundll32.exe	WerFault.exe
PID 4648 wrote to memory of 1424	4648	rundll32.exe	WerFault.exe
PID 4648 wrote to memory of 1424	4648	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e3605efb4ec3234178081248fd155c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e3605efb4ec3234178081248fd155c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 692
    3⤵
    - Program crash
    PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 692
    3⤵
    - Program crash
    PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4648 -ip 4648
1⤵
PID:1004

memory/4648-0-0x0000000002C40000-0x0000000002C46000-memory.dmp

Filesize
24KB

Download
memory/4648-1-0x00000000757E0000-0x0000000075810000-memory.dmp

Filesize
192KB

Download
memory/4648-5-0x0000000002C40000-0x0000000002C46000-memory.dmp

Filesize
24KB

Download