dridex | 9fb41ef59d559e433e1c6f9552e87f5050bac5d87fbefe272b6a13c56c886998

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f975739c8f0abef5dbdda0a8480ee314_JaffaCakes118.dll
Size 188KB
Sample240419-elercshb51
SHA256 9fb41ef59d559e433e1c6f9552e87f5050bac5d87fbefe272b6a13c56c886998
MD5 f975739c8f0abef5dbdda0a8480ee314
SHA1 8e534e0db64b1c03d980fd7120d67ddf704bda48
SHA512 ea81469a42563187627bcf21ecd4b3e35b9cbf53a594bc781caf24937a1b7acc49037610eeee2d889f080ad1faafe6b1e12c7af66757f1871bffe5effff080bc
SSDEEP 3072:hA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAowo:hzIqATVfQeV2FZalKq6jtGJWuTmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/444-0-0x0000000075750000-0x0000000075780000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4956	444	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 444	1856	rundll32.exe	85
PID 1856 wrote to memory of 444	1856	rundll32.exe	85
PID 1856 wrote to memory of 444	1856	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f975739c8f0abef5dbdda0a8480ee314_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f975739c8f0abef5dbdda0a8480ee314_JaffaCakes118.dll,#1
  2⤵
  PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 688
    3⤵
    - Program crash
    PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 444 -ip 444
1⤵
PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-0-0x0000000075750000-0x0000000075780000-memory.dmp

Download

memory/444-1-0x0000000000D20000-0x0000000000D26000-memory.dmp