dridex | 98ba750767903db60612369c2dd19759ab9e7c47affa9ee5fbeaa8a5c6e4bca5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 12:59

Target

ff547c3d4672758597a0b6051771ff7a_JaffaCakes118.dll
Size

188KB
MD5

ff547c3d4672758597a0b6051771ff7a
SHA1

18f6aaa3cd39acec2b8510b2c9dba82667927989
SHA256

98ba750767903db60612369c2dd19759ab9e7c47affa9ee5fbeaa8a5c6e4bca5
SHA512

404d64d0da818a60d36f69186da706b03708bf83268b6e553a4f8b7470b36c3e7cedc9df58625b711c9807e7c5b9e26890892c30a8f936515420df1674eb7834
SSDEEP

3072:GA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoZo:GzIqATVfQeV2FZalKq6jtGJWuTmd

Score

10^/10

Family

dridex

Botnet

22201

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/232-0-0x0000000074BA0000-0x0000000074BD0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

316 232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
316	232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3992 wrote to memory of 232	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 232	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 232	3992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff547c3d4672758597a0b6051771ff7a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff547c3d4672758597a0b6051771ff7a_JaffaCakes118.dll,#1
2⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 692
3⤵
- Program crash
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:2868

memory/232-0-0x0000000074BA0000-0x0000000074BD0000-memory.dmp

Filesize
192KB

Download
memory/232-1-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

Filesize
24KB

Download