dridex | 1c4c92a73c75b1cc5c8aee4ae860aacd8b1dad017d45fc11c01852ef8705a783

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 12:01

Target

e4e08232484ec192a216b4d94a36e20b_JaffaCakes118.dll
Size

184KB
MD5

e4e08232484ec192a216b4d94a36e20b
SHA1

62dce684d4a67a537d79bd2cc38d4867ba659145
SHA256

1c4c92a73c75b1cc5c8aee4ae860aacd8b1dad017d45fc11c01852ef8705a783
SHA512

7c7b35cb7f619171bee15bee13a539e942e7c3d2626fad34db85918afdda6f6f0050a8098e9522e45572bb5db176171beb00e7b722b2eef3e525bc237a01feed
SSDEEP

3072:/hd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33J/VQcY:/3fOeIv54W6SFKfc9me9v9/J/V

Score

10^/10

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/856-0-0x0000000074EB0000-0x0000000074EE0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3928 856 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3928	856	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 856	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 856	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 856	2524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4e08232484ec192a216b4d94a36e20b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4e08232484ec192a216b4d94a36e20b_JaffaCakes118.dll,#1
2⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 668
3⤵
- Program crash
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 856 -ip 856
1⤵
PID:1076

memory/856-0-0x0000000074EB0000-0x0000000074EE0000-memory.dmp

Filesize
192KB

Download
memory/856-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download