dridex | f0808c5bec826d3345fc1a8869acb4921834d7b93e2a5c062d982a8a0fac296b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 12:37

Target

dba547186b6053b384a090f38dde93ca.dll
Size

184KB
MD5

dba547186b6053b384a090f38dde93ca
SHA1

fa42167aa7487dae9fb5349843011342c3c51f6f
SHA256

f0808c5bec826d3345fc1a8869acb4921834d7b93e2a5c062d982a8a0fac296b
SHA512

fc299ab5f6e768dab9bfc05fefc46d81cf1f905a6345db8a5be7cf91084eb9cf982e655b2d0a8f6877739837c6c2fecc2aebdc9c39cecd02c27b3715ecb81586
SSDEEP

3072:mhd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JzVQcY:m3fOeIv54W6SFKfc9me9v9/JzV

Score

10^/10

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4160-0-0x00000000753D0000-0x0000000075400000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1576 4160 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1576	4160	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 4160	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 4160	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 4160	1672	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dba547186b6053b384a090f38dde93ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dba547186b6053b384a090f38dde93ca.dll,#1
2⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 668
3⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4160 -ip 4160
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600

memory/4160-1-0x00000000010E0000-0x00000000010E6000-memory.dmp

Filesize
24KB

Download
memory/4160-0-0x00000000753D0000-0x0000000075400000-memory.dmp

Filesize
192KB

Download