dridex | 69d15e4b7b95b72291bb0a29e2ce5186b895d490610518908eee7c8daa36af0f

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 19:12

Target

e5a7c263e1f82aa009442d9a85d885bb_JaffaCakes118.dll
Size

188KB
MD5

e5a7c263e1f82aa009442d9a85d885bb
SHA1

cc251c6a81b72c191ff30eb33feda62d8691d535
SHA256

69d15e4b7b95b72291bb0a29e2ce5186b895d490610518908eee7c8daa36af0f
SHA512

54663af7e74717b0b00e9fed1778f1be2b4b44c11f0ddf29917ae0e05a6bde62a31c1a67257e76f326a9574374d1cee67a1d9a463cb6e6551aae710cb7511cf2
SSDEEP

3072:9H0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWs7dU:9Uua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4852-1-0x0000000075070000-0x00000000750A0000-memory.dmp	dridex_ldr
behavioral2/memory/4852-2-0x0000000075070000-0x00000000750A0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3392 4852 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3392	4852	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 224 wrote to memory of 4852	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 4852	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 4852	224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5a7c263e1f82aa009442d9a85d885bb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5a7c263e1f82aa009442d9a85d885bb_JaffaCakes118.dll,#1
2⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 688
3⤵
- Program crash
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4852 -ip 4852
1⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:4240

memory/4852-0-0x0000000000870000-0x0000000000876000-memory.dmp

Filesize
24KB

Download
memory/4852-1-0x0000000075070000-0x00000000750A0000-memory.dmp

Filesize
192KB

Download
memory/4852-2-0x0000000075070000-0x00000000750A0000-memory.dmp

Filesize
192KB

Download
memory/4852-4-0x0000000000870000-0x0000000000876000-memory.dmp

Filesize
24KB

Download