dridex | f68a9a3258cde57d10b23d65f59db22700a288581ce2f11dfcde76918975242a

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e65687766a84e746fb4b4ae278d16129_JaffaCakes118.dll
Size

184KB
MD5

e65687766a84e746fb4b4ae278d16129
SHA1

7c1c96b068e911c4bab4c4de51132437a279207b
SHA256

f68a9a3258cde57d10b23d65f59db22700a288581ce2f11dfcde76918975242a
SHA512

922a23a16be8b54f1eadba28595f5af30ac13a819a330cd9e62caa5c05e40a0dbb5b8209a816e7e11ab1d1ec32b286dcc1ccef304ed9d511c3964e5e6a6660ca
SSDEEP

3072:mhd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JBVQcY:m3fOeIv54W6SFKfc9me9v9/JBV

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1724-0-0x0000000074DB0000-0x0000000074DE0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 1724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2984	1724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 1724	2192	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2984	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2984	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2984	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2984	1724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e65687766a84e746fb4b4ae278d16129_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e65687766a84e746fb4b4ae278d16129_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 280
3⤵
- Program crash
PID:2984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000074DB0000-0x0000000074DE0000-memory.dmp

Filesize
192KB

Download
memory/1724-2-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download