dridex | a1ebfce9633f10bf9992e7e220d63e1cc8ac35befc9bef20fbb81abbcfad3bb2

Analysis

max time kernel
123s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 10:11

Target

db5cccbba844600fa27354ebb360589d.dll
Size

188KB
MD5

db5cccbba844600fa27354ebb360589d
SHA1

6fb1d6769c625c5ed72f819e9e2c7a9b1eb6a6a0
SHA256

a1ebfce9633f10bf9992e7e220d63e1cc8ac35befc9bef20fbb81abbcfad3bb2
SHA512

1ea2c32b61f3e46db248342ebde45b018c0621d057ade80b9e949b5faf5a45665f62ccaa48b0c46187f3bc2642f54035259065d22c121d2d318d4c145ec920bf
SSDEEP

3072:BA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoSo:BzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/5056-0-0x00000000757A0000-0x00000000757D0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 5056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3688	5056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 232 wrote to memory of 5056	232	rundll32.exe	rundll32.exe
PID 232 wrote to memory of 5056	232	rundll32.exe	rundll32.exe
PID 232 wrote to memory of 5056	232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db5cccbba844600fa27354ebb360589d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db5cccbba844600fa27354ebb360589d.dll,#1
2⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 692
3⤵
- Program crash
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5056 -ip 5056
1⤵
PID:4068

memory/5056-0-0x00000000757A0000-0x00000000757D0000-memory.dmp

Filesize
192KB

Download
memory/5056-1-0x0000000000B70000-0x0000000000B76000-memory.dmp

Filesize
24KB

Download