dridex | b6d05bb99e7f3b07b9cadd957355d96dbe83e0379925a0feec165fadccc056ba

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8e72ae8b60023a2ebeff417f87cbb7e.dll
Size 188KB
Sample240320-qmapkshd59
SHA256 b6d05bb99e7f3b07b9cadd957355d96dbe83e0379925a0feec165fadccc056ba
MD5 d8e72ae8b60023a2ebeff417f87cbb7e
SHA1 6989d00b37486e3b1be28a49f4944cf5c3288d32
SHA512 70e32e89f30c964f4d334a76289b33092595a819c00c39827c5ac1ac6e8ff592735be401f25cbc279c372470a27a75794fd96dd1f68a06e2aeb0e535cc4f17bf
SSDEEP 3072:mA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAovo:mzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/2520-0-0x0000000074910000-0x0000000074940000-memory.dmp	dridex_ldr
behavioral2/memory/2520-2-0x0000000074910000-0x0000000074940000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	2520	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2520	4004	rundll32.exe	83
PID 4004 wrote to memory of 2520	4004	rundll32.exe	83
PID 4004 wrote to memory of 2520	4004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8e72ae8b60023a2ebeff417f87cbb7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8e72ae8b60023a2ebeff417f87cbb7e.dll,#1
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 688
    3⤵
    - Program crash
    PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2520 -ip 2520
1⤵
PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x0000000074910000-0x0000000074940000-memory.dmp

Download

memory/2520-1-0x0000000001390000-0x0000000001396000-memory.dmp

Download

memory/2520-2-0x0000000074910000-0x0000000074940000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads