dridex | 2c629014f909b04c1e35a8edf07c64fcf5945246f23a95ff693c7f8f5336a066

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll
Size

188KB
MD5

f73f5def06c315a90f3665830bae8562
SHA1

5c655534fb9d34c0ad9bbab970de703249155438
SHA256

2c629014f909b04c1e35a8edf07c64fcf5945246f23a95ff693c7f8f5336a066
SHA512

c1abccdfbfc7fcac6c938f458da733f399af77557c17cce706bd47d09b2e9f0ffe59e46dfcf1d84caa64da50debc35322b1b3071b62062680210ac31214773d0
SSDEEP

3072:2A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoao:2zIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2720-0-0x0000000074F70000-0x0000000074FA0000-memory.dmp	dridex_ldr
behavioral1/memory/2720-1-0x0000000074F70000-0x0000000074FA0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2896 2720 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2896	2720	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2720	2220	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2896	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2896	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2896	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2896	2720	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 300
3⤵
- Program crash
PID:2896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-0-0x0000000074F70000-0x0000000074FA0000-memory.dmp

Filesize
192KB

Download
memory/2720-1-0x0000000074F70000-0x0000000074FA0000-memory.dmp

Filesize
192KB

Download
memory/2720-2-0x0000000000100000-0x0000000000106000-memory.dmp

Filesize
24KB

Download