dridex | 2c629014f909b04c1e35a8edf07c64fcf5945246f23a95ff693c7f8f5336a066

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 04:17

Target

f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll
Size

188KB
MD5

f73f5def06c315a90f3665830bae8562
SHA1

5c655534fb9d34c0ad9bbab970de703249155438
SHA256

2c629014f909b04c1e35a8edf07c64fcf5945246f23a95ff693c7f8f5336a066
SHA512

c1abccdfbfc7fcac6c938f458da733f399af77557c17cce706bd47d09b2e9f0ffe59e46dfcf1d84caa64da50debc35322b1b3071b62062680210ac31214773d0
SSDEEP

3072:2A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoao:2zIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1904-0-0x0000000075670000-0x00000000756A0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

500 1904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
500	1904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1928 wrote to memory of 1904	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 1904	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 1904	1928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f5def06c315a90f3665830bae8562_JaffaCakes118.dll,#1
2⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 692
3⤵
- Program crash
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1904 -ip 1904
1⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2132

memory/1904-0-0x0000000075670000-0x00000000756A0000-memory.dmp

Filesize
192KB

Download
memory/1904-1-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

Filesize
24KB

Download