dridex | 787f9ce5786c837cce6d5d25249cecbc074fa89b458163b87c1b933aa6c1b58a

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll
Size

184KB
MD5

e6a350e904297f9c84c21bdb01f1a319
SHA1

19b09b365ac321e1f6c34b04cc890e37b13cf12c
SHA256

787f9ce5786c837cce6d5d25249cecbc074fa89b458163b87c1b933aa6c1b58a
SHA512

551d74f0ecca4407cafbb493d5fdf0b700cf224907f9007e6903536d3fb7eae562d56fae864732013768aa2c677159334ad17fcd91445d8f07a10b5c29963bd7
SSDEEP

3072:chd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JNVQcY:c3fOeIv54W6SFKfc9me9v9/JNV

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2912-0-0x00000000752F0000-0x0000000075320000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1136 2912 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1136	2912	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2912	2508	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 1136	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 1136	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 1136	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 1136	2912	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 288
3⤵
- Program crash
PID:1136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x00000000752F0000-0x0000000075320000-memory.dmp

Filesize
192KB

Download
memory/2912-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download