dridex | 787f9ce5786c837cce6d5d25249cecbc074fa89b458163b87c1b933aa6c1b58a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 04:30

Target

e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll
Size

184KB
MD5

e6a350e904297f9c84c21bdb01f1a319
SHA1

19b09b365ac321e1f6c34b04cc890e37b13cf12c
SHA256

787f9ce5786c837cce6d5d25249cecbc074fa89b458163b87c1b933aa6c1b58a
SHA512

551d74f0ecca4407cafbb493d5fdf0b700cf224907f9007e6903536d3fb7eae562d56fae864732013768aa2c677159334ad17fcd91445d8f07a10b5c29963bd7
SSDEEP

3072:chd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JNVQcY:c3fOeIv54W6SFKfc9me9v9/JNV

Score

10^/10

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
botnet loader

Processes:

resource yara_rule

behavioral2/memory/1040-0-0x0000000074A80000-0x0000000074AB0000-memory.dmp dridex_ldr
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4032 1040 WerFault.exe rundll32.exe

resource	yara_rule
behavioral2/memory/1040-0-0x0000000074A80000-0x0000000074AB0000-memory.dmp	dridex_ldr

pid	pid_target	process	target process
4032	1040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2928 wrote to memory of 1040	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 1040	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 1040	2928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6a350e904297f9c84c21bdb01f1a319_JaffaCakes118.dll,#1
2⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 676
3⤵
- Program crash
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1040 -ip 1040
1⤵
PID:2400

memory/1040-0-0x0000000074A80000-0x0000000074AB0000-memory.dmp

Filesize
192KB

Download
memory/1040-1-0x0000000001440000-0x0000000001446000-memory.dmp

Filesize
24KB

Download