dridex | 83d35509a19b8efb0bbd5f03d608f60f51c56fdf9769a3aa7260e4c98df181f2

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de4ca3422cf5c482e310ed63b6a94fd7.dll
Size 188KB
Sample240325-sg7s8sbd42
SHA256 83d35509a19b8efb0bbd5f03d608f60f51c56fdf9769a3aa7260e4c98df181f2
MD5 de4ca3422cf5c482e310ed63b6a94fd7
SHA1 5ee146fcd523b593604a4013ace4eedb61dc988b
SHA512 ef2f162c08d162aab8b008ce264f7323d03451e538b94d13f6a6817510c0010b7b56de1236e0248d6597d952093266b4a4009f2c0220891c7cbc7e2cc4b3fe10
SSDEEP 3072:ZA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoro:ZzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/5040-1-0x0000000075310000-0x0000000075340000-memory.dmp	dridex_ldr
behavioral2/memory/5040-2-0x0000000075310000-0x0000000075340000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3312	5040	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5040	540	rundll32.exe	85
PID 540 wrote to memory of 5040	540	rundll32.exe	85
PID 540 wrote to memory of 5040	540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de4ca3422cf5c482e310ed63b6a94fd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de4ca3422cf5c482e310ed63b6a94fd7.dll,#1
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 688
    3⤵
    - Program crash
    PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5040 -ip 5040
1⤵
PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5040-1-0x0000000075310000-0x0000000075340000-memory.dmp

Download

memory/5040-0-0x0000000000F90000-0x0000000000F96000-memory.dmp

Download

memory/5040-2-0x0000000075310000-0x0000000075340000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads