dridex | 881f157d9961d6839750b15511fc4b37354a320b4ad56fece128fc794fe41dac

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 17:36

Target

e23722f5022a7fa59756cf9c6f0a364d.dll
Size

184KB
MD5

e23722f5022a7fa59756cf9c6f0a364d
SHA1

affb30019f057bc9748498abb994285bcc9c26be
SHA256

881f157d9961d6839750b15511fc4b37354a320b4ad56fece128fc794fe41dac
SHA512

a3e2a7511dcad4a5dddced493bb04c6f023852bf9a39a3e263f221d5fc79ddf1ee75b870f99b0dc4e040930441e5fa7aba96f66dd458beadd7e6223f9267524e
SSDEEP

3072:Ihd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JXVQcY:I3fOeIv54W6SFKfc9me9v9/JXV

Score

10^/10

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4136-1-0x0000000074DF0000-0x0000000074E20000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2948 4136 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2948	4136	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4224 wrote to memory of 4136	4224	rundll32.exe	rundll32.exe
PID 4224 wrote to memory of 4136	4224	rundll32.exe	rundll32.exe
PID 4224 wrote to memory of 4136	4224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e23722f5022a7fa59756cf9c6f0a364d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e23722f5022a7fa59756cf9c6f0a364d.dll,#1
2⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 668
3⤵
- Program crash
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4136 -ip 4136
1⤵
PID:1900

memory/4136-0-0x00000000012B0000-0x00000000012B6000-memory.dmp

Filesize
24KB

Download
memory/4136-1-0x0000000074DF0000-0x0000000074E20000-memory.dmp

Filesize
192KB

Download
memory/4136-3-0x00000000012B0000-0x00000000012B6000-memory.dmp

Filesize
24KB

Download