dridex | ea3300223c459fe18bac3cf852030fb16d2439b842e4fa4ef6a2dcf7a52b8344

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 05:56

Target

dadc592cb18b079b0257928fd637e531.dll
Size

188KB
MD5

dadc592cb18b079b0257928fd637e531
SHA1

895328b01b7c25ff3eb36ad6876c277be7387f49
SHA256

ea3300223c459fe18bac3cf852030fb16d2439b842e4fa4ef6a2dcf7a52b8344
SHA512

903b571f7c52616e2d3f9fe9b63aaabea65b65e49c2717d4cc4a94888e8cdcf44febf8a81582f131ba6cdd1df1edaf5c5e0e13bbb31445f58951fec536f31b61
SSDEEP

3072:SA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoHo:SzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2272-0-0x0000000075230000-0x0000000075260000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1004 2272 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1004	2272	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4844 wrote to memory of 2272	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 2272	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 2272	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dadc592cb18b079b0257928fd637e531.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dadc592cb18b079b0257928fd637e531.dll,#1
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 688
    3⤵
    - Program crash
    PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2272 -ip 2272
1⤵
PID:2764

memory/2272-0-0x0000000075230000-0x0000000075260000-memory.dmp

Filesize
192KB

Download
memory/2272-1-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

Filesize
24KB

Download