dridex | 4ab0e5ad345218dc2add7972ccda5f1bf7501e58601d112acdc5c9fee90c02e6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 06:15

Target

dae507b2b4b25ab63b3e3c5dc29615cc.dll
Size

188KB
MD5

dae507b2b4b25ab63b3e3c5dc29615cc
SHA1

ee0822320134e4943eaac29a4d577704775d8f62
SHA256

4ab0e5ad345218dc2add7972ccda5f1bf7501e58601d112acdc5c9fee90c02e6
SHA512

9e1e00d9e12476fe0559e97df96fdc1365c2929a60d3259e8ebb4e21230f88cf5cb6b18fe4d8110360ef6fc0ea67b9427503ed3b35cac72633a294f65701a9c6
SSDEEP

3072:6A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoto:6zIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2756-0-0x0000000075130000-0x0000000075160000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3144 2756 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3144	2756	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3356 wrote to memory of 2756	3356	rundll32.exe	rundll32.exe
PID 3356 wrote to memory of 2756	3356	rundll32.exe	rundll32.exe
PID 3356 wrote to memory of 2756	3356	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dae507b2b4b25ab63b3e3c5dc29615cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dae507b2b4b25ab63b3e3c5dc29615cc.dll,#1
2⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 688
3⤵
- Program crash
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2756 -ip 2756
1⤵
PID:2508

memory/2756-0-0x0000000075130000-0x0000000075160000-memory.dmp

Filesize
192KB

Download
memory/2756-1-0x0000000002630000-0x0000000002636000-memory.dmp

Filesize
24KB

Download