dridex | 5554eabea745c4fb83880a12faa9b0342516506f76794f43e1c94b7abd49c2d2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:16

Target

eb417789aee8f498fc21d15231af3903_JaffaCakes118.dll
Size

188KB
MD5

eb417789aee8f498fc21d15231af3903
SHA1

b0fff128f463839fe2198f53bce0b2a93e527058
SHA256

5554eabea745c4fb83880a12faa9b0342516506f76794f43e1c94b7abd49c2d2
SHA512

24a13fb8cee7ec8af836a9e98975cd40e3b58f52c0404cc24c1a002e8bc68d1d28e48d11cae0c95bdf86980c1e8487c1c918098b419282a9ec198ed24cb23d31
SSDEEP

3072:TA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoVo:TzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/3996-0-0x00000000754A0000-0x00000000754D0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3008 3996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3008	3996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 3996	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 3996	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 3996	1156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb417789aee8f498fc21d15231af3903_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb417789aee8f498fc21d15231af3903_JaffaCakes118.dll,#1
2⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 688
3⤵
- Program crash
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3996 -ip 3996
1⤵
PID:1028

memory/3996-0-0x00000000754A0000-0x00000000754D0000-memory.dmp

Filesize
192KB

Download
memory/3996-1-0x0000000000990000-0x0000000000996000-memory.dmp

Filesize
24KB

Download