dridex | 43ae1efd62f5cab7b44c4d7fd9f59fd4bec5492e096efa22909701d4290843a8

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll
Size

188KB
MD5

f556957e4828d87e3c4716e7dd5eaf04
SHA1

9c454bc3a714c1d75fb58a4182fd497ff2545eef
SHA256

43ae1efd62f5cab7b44c4d7fd9f59fd4bec5492e096efa22909701d4290843a8
SHA512

fa61dac5af6d6d5ca6d9850cfe61be073c487d593501badc2b78a87151a18128e6a349220c85e1cc0635b85cd293b75b7164b2e2461326e217a1f014a710bda5
SSDEEP

3072:IA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAojo:IzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2112-0-0x00000000745C0000-0x00000000745F0000-memory.dmp	dridex_ldr
behavioral1/memory/2112-2-0x00000000745C0000-0x00000000745F0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 2112 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2900	2112	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2112	2384	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 2900	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 2900	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 2900	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 2900	2112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 300
3⤵
- Program crash
PID:2900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x00000000745C0000-0x00000000745F0000-memory.dmp

Filesize
192KB

Download
memory/2112-1-0x00000000000C0000-0x00000000000C6000-memory.dmp

Filesize
24KB

Download
memory/2112-2-0x00000000745C0000-0x00000000745F0000-memory.dmp

Filesize
192KB

Download