dridex | 9d22ac36eaf345e336ca6b4c25b9b86af1cafee67b7c3c821cd66cbd6f4fecce

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebde200e05320d4861593e33fb99f05c_JaffaCakes118.dll
Size

188KB
MD5

ebde200e05320d4861593e33fb99f05c
SHA1

22889ce512fcd25e70a4a1dc367c05d737901bf9
SHA256

9d22ac36eaf345e336ca6b4c25b9b86af1cafee67b7c3c821cd66cbd6f4fecce
SHA512

7a857b121dfeeb8b1d0393ec6978dc55a67f8d8389263c44f62a4cc5cb278acb157a8375d15c7fa8f2015070a8986a384e50193ff89451513a644856c9903b66
SSDEEP

3072:GA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo1o:GzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1884-0-0x0000000074F80000-0x0000000074FB0000-memory.dmp	dridex_ldr
behavioral1/memory/1884-2-0x0000000074F80000-0x0000000074FB0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 1884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2968	1884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1884	1044	rundll32.exe	rundll32.exe
PID 1884 wrote to memory of 2968	1884	rundll32.exe	WerFault.exe
PID 1884 wrote to memory of 2968	1884	rundll32.exe	WerFault.exe
PID 1884 wrote to memory of 2968	1884	rundll32.exe	WerFault.exe
PID 1884 wrote to memory of 2968	1884	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebde200e05320d4861593e33fb99f05c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebde200e05320d4861593e33fb99f05c_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 300
3⤵
- Program crash
PID:2968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-0-0x0000000074F80000-0x0000000074FB0000-memory.dmp

Filesize
192KB

Download
memory/1884-1-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/1884-2-0x0000000074F80000-0x0000000074FB0000-memory.dmp

Filesize
192KB

Download