dridex | d86a0d5f3011d5acd548f5f22f80ca79130b29b8e5e1bb049d921c65808e121e

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 13:21

Target

ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c.dll
Size

518KB
MD5

153bc84ce38485a27ee114e9bcd4eef9
SHA1

821ced6f8b1083a085f224210f82c0f301887f7a
SHA256

ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c
SHA512

d9b0851d74424c348f530152332eed376b9231e0e9832588143d5dc39c5151d2e654c7931c1ba2a1098f0a3d077ec13aeaab9b174f8a2d4f870d87e43c536fcf
SSDEEP

12288:B+8mHYABWaGPleAupQFpa7M5YXsXx5pgKB/Z:RmHBXGPlcQF87M5fBHBZ

Score

10^/10

dridex 10444 botnet

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 2140	3016	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ce6b05e2593182af90dc4e8fd315240bec81cf0734a2590ee864a05bbffb014c.dll
2⤵
PID:2140

memory/2140-0-0x0000000001E10000-0x0000000001F08000-memory.dmp

Filesize
992KB

Download
memory/2140-1-0x0000000001E10000-0x0000000001F08000-memory.dmp

Filesize
992KB

Download
memory/2140-2-0x0000000001E10000-0x0000000001F08000-memory.dmp

Filesize
992KB

Download
memory/2140-3-0x0000000001E10000-0x0000000001F08000-memory.dmp

Filesize
992KB

Download
memory/2140-7-0x0000000001E10000-0x0000000001F08000-memory.dmp

Filesize
992KB

Download