dridex | 13e14e38c7b273c7cceb7c8333e132eedea3ce71bc3339bca783dccb81a43652

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f645c07e9d37d645c74a08f131bb76e4_JaffaCakes118.dll
Size

188KB
MD5

f645c07e9d37d645c74a08f131bb76e4
SHA1

32410da75e3c5e06c365dd8281ccc4b0f359463f
SHA256

13e14e38c7b273c7cceb7c8333e132eedea3ce71bc3339bca783dccb81a43652
SHA512

7b0459dd4a18de8327ec65631e04ee50a2b502aaaf6b6e4b51f8696dd66bd20cee67837096e5a78468786533b67074a70995ef68ab846e3e6204df46c99899d9
SSDEEP

3072:JH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWO7dU:JUua/Pv7YNhRIEZDeXVpAxtMsxK

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2128-0-0x0000000074990000-0x00000000749C0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3068 2128 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3068	2128	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 2128	1660	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 3068	2128	rundll32.exe	WerFault.exe
PID 2128 wrote to memory of 3068	2128	rundll32.exe	WerFault.exe
PID 2128 wrote to memory of 3068	2128	rundll32.exe	WerFault.exe
PID 2128 wrote to memory of 3068	2128	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f645c07e9d37d645c74a08f131bb76e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f645c07e9d37d645c74a08f131bb76e4_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 300
3⤵
- Program crash
PID:3068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000074990000-0x00000000749C0000-memory.dmp

Filesize
192KB

Download
memory/2128-1-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download