dridex | 43ae1efd62f5cab7b44c4d7fd9f59fd4bec5492e096efa22909701d4290843a8

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 08:09

Target

f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll
Size

188KB
MD5

f556957e4828d87e3c4716e7dd5eaf04
SHA1

9c454bc3a714c1d75fb58a4182fd497ff2545eef
SHA256

43ae1efd62f5cab7b44c4d7fd9f59fd4bec5492e096efa22909701d4290843a8
SHA512

fa61dac5af6d6d5ca6d9850cfe61be073c487d593501badc2b78a87151a18128e6a349220c85e1cc0635b85cd293b75b7164b2e2461326e217a1f014a710bda5
SSDEEP

3072:IA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAojo:IzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/544-0-0x0000000074FD0000-0x0000000075000000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 544 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1016	544	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4456 wrote to memory of 544	4456	rundll32.exe	rundll32.exe
PID 4456 wrote to memory of 544	4456	rundll32.exe	rundll32.exe
PID 4456 wrote to memory of 544	4456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f556957e4828d87e3c4716e7dd5eaf04_JaffaCakes118.dll,#1
2⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 692
3⤵
- Program crash
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 544 -ip 544
1⤵
PID:376

memory/544-0-0x0000000074FD0000-0x0000000075000000-memory.dmp

Filesize
192KB

Download
memory/544-1-0x00000000010E0000-0x00000000010E6000-memory.dmp

Filesize
24KB

Download