dridex | 64f50adfd615fe807b4ab26bfbfca841b21c1b4e9a850f4c86ad2f3ed3cf36d7

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fefc9f501da2681dc1f61f4bea1abc34_JaffaCakes118.dll
Size

188KB
MD5

fefc9f501da2681dc1f61f4bea1abc34
SHA1

9c138017b5d7a73993032c309ebfe2d7927641e4
SHA256

64f50adfd615fe807b4ab26bfbfca841b21c1b4e9a850f4c86ad2f3ed3cf36d7
SHA512

f09e8075879d3b7a3128a6a4049837b7221d86e422a36ef265de97ceb821637410c15c5ce6d2ca1c683415c5e66ab5f732fc963091e5c6f54833abb87552b4b1
SSDEEP

3072:MA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAojo:MzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/3068-0-0x0000000074A50000-0x0000000074A80000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2956 3068 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2956	3068	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2956	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2956	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2956	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2956	3068	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fefc9f501da2681dc1f61f4bea1abc34_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fefc9f501da2681dc1f61f4bea1abc34_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 300
3⤵
- Program crash
PID:2956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000074A50000-0x0000000074A80000-memory.dmp

Filesize
192KB

Download
memory/3068-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download