dridex | 8c8896ec10234612dd5063dfa4f84ca815ace19c4c2b0b3def9c29be0029f390

Analysis

max time kernel
55s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 06:25

Target
0704068b7be5426f38f2da38c965d04e_JaffaCakes118.dll
Size 280KB
Sample240429-g6waysce63
SHA256 8c8896ec10234612dd5063dfa4f84ca815ace19c4c2b0b3def9c29be0029f390
MD5 0704068b7be5426f38f2da38c965d04e
SHA1 80ef0434d370a4b112cb632b1868aad93d53a9bd
SHA512 042f7eb2107965149f7cd249de9adcda4a5367d5a789fa4cc71450332f80c7c1d861653646c57faeebe173ca2371530585f0dd36b9164f46132f0652eaa98808
SSDEEP 6144:SqUtrd+yrmjlZI3vIVMPN6SG2H9X0A6NPXiGmJ5WMm:Sz+yoZIwVMPN6SG2x0dNfiGuI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

resource	yara_rule
behavioral2/memory/2888-1-0x0000000000400000-0x000000000045C000-memory.dmp	dridex_ldr_dmod

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 2888	3788	regsvr32.exe	86
PID 3788 wrote to memory of 2888	3788	regsvr32.exe	86
PID 3788 wrote to memory of 2888	3788	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0704068b7be5426f38f2da38c965d04e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0704068b7be5426f38f2da38c965d04e_JaffaCakes118.dll
  2⤵
  PID:2888

memory/2888-1-0x0000000000400000-0x000000000045C000-memory.dmp

Download