dridex | 5ce8fded69d07911ac26d078200f2e91bae4b4221c1f876aaa3e2275a5cbcc08

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll
Size

188KB
MD5

faa41cd840abce38059a4ffc3b4385dc
SHA1

d3f7f1c075a1d2d049b451e2db99b6bd328cbd77
SHA256

5ce8fded69d07911ac26d078200f2e91bae4b4221c1f876aaa3e2275a5cbcc08
SHA512

74da9c312ee6e38f4d38a183dd8347234c3e4bc55ae491641eba1694634558366bbb1614e67faf1cc4ef714dae0f20cf7560ab17ad9b402140d43f46924d6d83
SSDEEP

3072:oxA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoHo:mzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/2204-0-0x00000000753C0000-0x00000000753F0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2144 2204 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2144	2204	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2204	1724	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2144	2204	rundll32.exe	WerFault.exe
PID 2204 wrote to memory of 2144	2204	rundll32.exe	WerFault.exe
PID 2204 wrote to memory of 2144	2204	rundll32.exe	WerFault.exe
PID 2204 wrote to memory of 2144	2204	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 300
3⤵
- Program crash
PID:2144

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x00000000753C0000-0x00000000753F0000-memory.dmp

Filesize
192KB

Download
memory/2204-2-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download