dridex | 1b00fe8173d957364da76381de9ca69419ae9ee93fa9ac30dd4cdd9d2cc20922

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f325de3b3f224cdfe8fb3b62a8ec5407_JaffaCakes118.dll
Size

188KB
MD5

f325de3b3f224cdfe8fb3b62a8ec5407
SHA1

7980fdec1c0bf4cd6745281f520d1c6f19244fcc
SHA256

1b00fe8173d957364da76381de9ca69419ae9ee93fa9ac30dd4cdd9d2cc20922
SHA512

d21815b77be1d220d9b85cf26bd942c1fcb986a5d2e095764d1b3381cec0f9d4beaeb95fb1e44d828240ad3ea3f9135138ccefe29d83116ce995ebc7a198a397
SSDEEP

3072:qA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAogo:qzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2012-0-0x00000000746F0000-0x0000000074720000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2372 2012 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2372	2012	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 2012	1444	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2372	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 2372	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 2372	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 2372	2012	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f325de3b3f224cdfe8fb3b62a8ec5407_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f325de3b3f224cdfe8fb3b62a8ec5407_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 300
3⤵
- Program crash
PID:2372

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x00000000746F0000-0x0000000074720000-memory.dmp

Filesize
192KB

Download
memory/2012-1-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download