dridex | 4a10e2f9c2a8000eb061864bd4c08c3d4e3c0c2e4db65db4ae52d158c9a5bf75

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 11:14

Target

e9dcdabf44fb446b2578e152b817f0b7_JaffaCakes118.dll
Size

188KB
MD5

e9dcdabf44fb446b2578e152b817f0b7
SHA1

bd6f0b0362948f09e104b8fc1c8fc45cebff48d9
SHA256

4a10e2f9c2a8000eb061864bd4c08c3d4e3c0c2e4db65db4ae52d158c9a5bf75
SHA512

6612617ce7346a36fc4d693bf0564fb792dbd2774ccc5ec6c61fe2232b82bd449597b78aa9d5e5a2543421b6706046403a75b21093587e499d5bdd74afe17e38
SSDEEP

3072:nA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoAo:nzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2724-0-0x0000000074A40000-0x0000000074A70000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

808 2724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
808	2724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4580 wrote to memory of 2724	4580	rundll32.exe	rundll32.exe
PID 4580 wrote to memory of 2724	4580	rundll32.exe	rundll32.exe
PID 4580 wrote to memory of 2724	4580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9dcdabf44fb446b2578e152b817f0b7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9dcdabf44fb446b2578e152b817f0b7_JaffaCakes118.dll,#1
2⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 692
3⤵
- Program crash
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2724 -ip 2724
1⤵
PID:3192

memory/2724-0-0x0000000074A40000-0x0000000074A70000-memory.dmp

Filesize
192KB

Download
memory/2724-1-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download