dridex | 9e41683d1143256df28a4be4cb848763f1be23f2f6819fbc4451383957c161d3

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 11:21

Target

e757e13ecddbe864da3af5dc4f60d884_JaffaCakes118.dll
Size

188KB
MD5

e757e13ecddbe864da3af5dc4f60d884
SHA1

c57bc71613aed71197dc056583e2354d59d89662
SHA256

9e41683d1143256df28a4be4cb848763f1be23f2f6819fbc4451383957c161d3
SHA512

7dd1f8b58d1480acaef24f91eb87e16f4cbeb3bcd48a0449583ff7bc62e22463d66cd608f6180a08b91482616cf99d747255f8f7a33c45625144715386b0f6bc
SSDEEP

3072:TA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoro:TzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4072-0-0x0000000074FB0000-0x0000000074FE0000-memory.dmp	dridex_ldr
behavioral2/memory/4072-2-0x0000000074FB0000-0x0000000074FE0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1544 4072 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1544	4072	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 4072	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 4072	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 4072	1680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e757e13ecddbe864da3af5dc4f60d884_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e757e13ecddbe864da3af5dc4f60d884_JaffaCakes118.dll,#1
2⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 688
3⤵
- Program crash
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4072 -ip 4072
1⤵
PID:4844

memory/4072-0-0x0000000074FB0000-0x0000000074FE0000-memory.dmp

Filesize
192KB

Download
memory/4072-1-0x0000000000B90000-0x0000000000B96000-memory.dmp

Filesize
24KB

Download
memory/4072-2-0x0000000074FB0000-0x0000000074FE0000-memory.dmp

Filesize
192KB

Download