dridex | 9a505140c8bc2c078283fcca2f49e972f6fb33da514e578136cc84b3cb17b0e3

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de29b0b70017a6201969ce93b9214a33.dll
Size

188KB
MD5

de29b0b70017a6201969ce93b9214a33
SHA1

76d31a26c2e274173fcccccc5e5eadf90730d662
SHA256

9a505140c8bc2c078283fcca2f49e972f6fb33da514e578136cc84b3cb17b0e3
SHA512

bb449bf33ca883ddfb1fcd6d31f3b7c625e21f940f4f09cbdd67b6fa017a9d771694a4074d7fb8d1abbd5d37a196d1f293138602cdd27067a6df3c6b7d2372c5
SSDEEP

3072:gA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo0o:gzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2176-0-0x00000000751A0000-0x00000000751D0000-memory.dmp	dridex_ldr
behavioral1/memory/2176-2-0x00000000751A0000-0x00000000751D0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2936 2176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2936	2176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2176	2360	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2936	2176	rundll32.exe	WerFault.exe
PID 2176 wrote to memory of 2936	2176	rundll32.exe	WerFault.exe
PID 2176 wrote to memory of 2936	2176	rundll32.exe	WerFault.exe
PID 2176 wrote to memory of 2936	2176	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29b0b70017a6201969ce93b9214a33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29b0b70017a6201969ce93b9214a33.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 300
3⤵
- Program crash
PID:2936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x00000000751A0000-0x00000000751D0000-memory.dmp

Filesize
192KB

Download
memory/2176-1-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/2176-2-0x00000000751A0000-0x00000000751D0000-memory.dmp

Filesize
192KB

Download