dridex | 31f8d357f5b523cd0c159f09d23a273c138dd6ce758018816320039098ecfbb7

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 03:35

Target

f2985f5648610b5880379b3e778aad1f_JaffaCakes118.dll
Size

184KB
MD5

f2985f5648610b5880379b3e778aad1f
SHA1

7b171f5e0b4e6a265b614ec43c47cfb9c4edbcaa
SHA256

31f8d357f5b523cd0c159f09d23a273c138dd6ce758018816320039098ecfbb7
SHA512

0765476a07d36ca3c73e1acd73731e0f836fdc7242fa578651dc2a81a06f7c9a5542f469c2ad99129d9aa9102e49621650b2cd70bca41f95d6b760b2c2dcd009
SSDEEP

3072:7hd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33J6VQcY:73fOeIv54W6SFKfc9me9v9/J6V

Score

10^/10

Family

dridex

Botnet

22201

51.79.50.122:443

222.124.142.67:10443

138.201.222.158:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/4332-0-0x0000000075180000-0x00000000751B0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2916 4332 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2916	4332	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4604 wrote to memory of 4332	4604	rundll32.exe	rundll32.exe
PID 4604 wrote to memory of 4332	4604	rundll32.exe	rundll32.exe
PID 4604 wrote to memory of 4332	4604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2985f5648610b5880379b3e778aad1f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2985f5648610b5880379b3e778aad1f_JaffaCakes118.dll,#1
2⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 668
3⤵
- Program crash
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4332 -ip 4332
1⤵
PID:872

memory/4332-0-0x0000000075180000-0x00000000751B0000-memory.dmp

Filesize
192KB

Download
memory/4332-1-0x00000000026B0000-0x00000000026B6000-memory.dmp

Filesize
24KB

Download