dridex | e84da0c917c8406ad24610577a6b1884aa71aa090062f68b0ef5f28b2ee7a01b

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 18:13

Target

dfca69fe1e634e92696b13032383eac6.dll
Size

188KB
MD5

dfca69fe1e634e92696b13032383eac6
SHA1

389b1dfdd56714d4e23145775e424f085e9b8b33
SHA256

e84da0c917c8406ad24610577a6b1884aa71aa090062f68b0ef5f28b2ee7a01b
SHA512

c4cc132ce3bca4c99d231847109a1c81b72d9f2000d2b7b6cb60676a19ab505d8cfc126d5414441ae52968835d8487329d2bacf587fb1d2a0a7969fdc9c4a84b
SSDEEP

3072:9A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoto:9zIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/8-0-0x0000000074BA0000-0x0000000074BD0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

400 8 WerFault.exe rundll32.exe

pid	pid_target	process	target process
400	8	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1476 wrote to memory of 8	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 8	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 8	1476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfca69fe1e634e92696b13032383eac6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfca69fe1e634e92696b13032383eac6.dll,#1
2⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 692
3⤵
- Program crash
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 8
1⤵
PID:2236

memory/8-0-0x0000000074BA0000-0x0000000074BD0000-memory.dmp

Filesize
192KB

Download
memory/8-1-0x00000000008D0000-0x00000000008D6000-memory.dmp

Filesize
24KB

Download