dridex | 27bbe7427232a77b70e1ca056f5d63da64a04d03b420c58c9cf0ac3b113e04d5

Analysis

max time kernel
113s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 18:14

Target

27bbe7427232a77b70e1ca056f5d63da64a04d03b420c58c9cf0ac3b113e04d5.dll
Size

180KB
MD5

89560f98fd5404f0dda37b026e33b6b4
SHA1

2b9d4dfd8f62d0e8679cd5a080500fbe799526e1
SHA256

27bbe7427232a77b70e1ca056f5d63da64a04d03b420c58c9cf0ac3b113e04d5
SHA512

2a85d8011b1ae1742de1c0507bf148ebd7e99216352e81f248609e6a0db20db15312bc429bad18eb25016bdd353dba66b789edaba43bccedb2d31f16273b3fa8
SSDEEP

3072:i3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:2UZYxfM8+YXfq+SOxTxjipQjzk3

Score

10^/10

Family

dridex

Botnet

111

94.126.8.2:443

81.2.235.131:1688

178.63.156.139:3388

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/3052-0-0x0000000075530000-0x000000007555E000-memory.dmp	dridex_ldr
behavioral1/memory/3052-2-0x0000000075530000-0x000000007555E000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27bbe7427232a77b70e1ca056f5d63da64a04d03b420c58c9cf0ac3b113e04d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27bbe7427232a77b70e1ca056f5d63da64a04d03b420c58c9cf0ac3b113e04d5.dll,#1
  2⤵
  PID:3052

memory/3052-0-0x0000000075530000-0x000000007555E000-memory.dmp

Filesize
184KB

Download
memory/3052-1-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/3052-2-0x0000000075530000-0x000000007555E000-memory.dmp

Filesize
184KB

Download