dridex | 5ce8fded69d07911ac26d078200f2e91bae4b4221c1f876aaa3e2275a5cbcc08

Analysis

max time kernel
139s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:51

Target

faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll
Size

188KB
MD5

faa41cd840abce38059a4ffc3b4385dc
SHA1

d3f7f1c075a1d2d049b451e2db99b6bd328cbd77
SHA256

5ce8fded69d07911ac26d078200f2e91bae4b4221c1f876aaa3e2275a5cbcc08
SHA512

74da9c312ee6e38f4d38a183dd8347234c3e4bc55ae491641eba1694634558366bbb1614e67faf1cc4ef714dae0f20cf7560ab17ad9b402140d43f46924d6d83
SSDEEP

3072:oxA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoHo:mzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2540-0-0x0000000074D20000-0x0000000074D50000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3440 2540 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3440	2540	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3528 wrote to memory of 2540	3528	rundll32.exe	rundll32.exe
PID 3528 wrote to memory of 2540	3528	rundll32.exe	rundll32.exe
PID 3528 wrote to memory of 2540	3528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa41cd840abce38059a4ffc3b4385dc_JaffaCakes118.dll,#1
2⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 692
3⤵
- Program crash
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2540 -ip 2540
1⤵
PID:2616

memory/2540-0-0x0000000074D20000-0x0000000074D50000-memory.dmp

Filesize
192KB

Download
memory/2540-1-0x0000000000CF0000-0x0000000000CF6000-memory.dmp

Filesize
24KB

Download