dridex | 8c5dd910e17d1e866cabb0cbfb1da8f54ee330640becc2962934003193156cb1

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0ce63a140df443f3ec90da8ead8343c.dll
Size 188KB
Sample240327-fd8vxagb2s
SHA256 8c5dd910e17d1e866cabb0cbfb1da8f54ee330640becc2962934003193156cb1
MD5 e0ce63a140df443f3ec90da8ead8343c
SHA1 63b0d35bcdc2e596590244c028367fd28ec36700
SHA512 a836c974a99da0f59c8155d4830ddc6f44f49933e5f0ed779a3f351119bc4a604a10b68b5b6bc172d27cc3c40b92c322ce713e0fe580ab0c5f1c02c8ffdf6649
SSDEEP 3072:hA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:hzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/1128-1-0x0000000074D00000-0x0000000074D30000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
720	1128	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1128	4800	rundll32.exe	87
PID 4800 wrote to memory of 1128	4800	rundll32.exe	87
PID 4800 wrote to memory of 1128	4800	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0ce63a140df443f3ec90da8ead8343c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0ce63a140df443f3ec90da8ead8343c.dll,#1
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 692
    3⤵
    - Program crash
    PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1128 -ip 1128
1⤵
PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-0-0x0000000000C90000-0x0000000000C96000-memory.dmp

Download

memory/1128-1-0x0000000074D00000-0x0000000074D30000-memory.dmp