dridex | 9a505140c8bc2c078283fcca2f49e972f6fb33da514e578136cc84b3cb17b0e3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 13:52

Target

de29b0b70017a6201969ce93b9214a33.dll
Size

188KB
MD5

de29b0b70017a6201969ce93b9214a33
SHA1

76d31a26c2e274173fcccccc5e5eadf90730d662
SHA256

9a505140c8bc2c078283fcca2f49e972f6fb33da514e578136cc84b3cb17b0e3
SHA512

bb449bf33ca883ddfb1fcd6d31f3b7c625e21f940f4f09cbdd67b6fa017a9d771694a4074d7fb8d1abbd5d37a196d1f293138602cdd27067a6df3c6b7d2372c5
SSDEEP

3072:gA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo0o:gzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1444-0-0x0000000074A40000-0x0000000074A70000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3300 1444 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3300	1444	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3308 wrote to memory of 1444	3308	rundll32.exe	rundll32.exe
PID 3308 wrote to memory of 1444	3308	rundll32.exe	rundll32.exe
PID 3308 wrote to memory of 1444	3308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29b0b70017a6201969ce93b9214a33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29b0b70017a6201969ce93b9214a33.dll,#1
2⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 692
3⤵
- Program crash
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1444 -ip 1444
1⤵
PID:3332

memory/1444-0-0x0000000074A40000-0x0000000074A70000-memory.dmp

Filesize
192KB

Download
memory/1444-1-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download