dridex | eeff87e3d94d5f03b28f3e3384726ce16dc68fbc0f3efafa3c8df202614b6c4d

Analysis

max time kernel
144s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 22:48

Target

ee858ed367aa5774d71258ed8fb61d92_JaffaCakes118.dll
Size

188KB
MD5

ee858ed367aa5774d71258ed8fb61d92
SHA1

f85f4f4cfb345cd21842f9646c3875c7374a8673
SHA256

eeff87e3d94d5f03b28f3e3384726ce16dc68fbc0f3efafa3c8df202614b6c4d
SHA512

d437f31c0f53e1c1b03f097058b51aeeb8e9d1686d827c0ce23687e3549ce54f2c05b48b4629a3b8dbbeb3d129ab1f90598268b6458aa0b28b85c5b74ccff39b
SSDEEP

3072:uH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViW07dU:uUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/3004-0-0x0000000074950000-0x0000000074980000-memory.dmp	dridex_ldr
behavioral2/memory/3004-2-0x0000000074950000-0x0000000074980000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5000 3004 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5000	3004	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3700 wrote to memory of 3004	3700	rundll32.exe	rundll32.exe
PID 3700 wrote to memory of 3004	3700	rundll32.exe	rundll32.exe
PID 3700 wrote to memory of 3004	3700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee858ed367aa5774d71258ed8fb61d92_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee858ed367aa5774d71258ed8fb61d92_JaffaCakes118.dll,#1
2⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 688
3⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3004 -ip 3004
1⤵
PID:116

memory/3004-0-0x0000000074950000-0x0000000074980000-memory.dmp

Filesize
192KB

Download
memory/3004-1-0x0000000001380000-0x0000000001386000-memory.dmp

Filesize
24KB

Download
memory/3004-2-0x0000000074950000-0x0000000074980000-memory.dmp

Filesize
192KB

Download