dridex | 2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e

Analysis

max time kernel
43s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 20:18

Target

9bce97f19e31a1e3b783ac32d2c726fa_JaffaCakes118.dll
Size

324KB
MD5

9bce97f19e31a1e3b783ac32d2c726fa
SHA1

77b24c8ba771792da6aec76f4ec248f0ecb235c3
SHA256

2d7c7b9472f1f4bb2f678822f16e8575971574ba763bd9e98fdb7d8b2a8f5d2e
SHA512

8bcd3785c816a469c6992583556e3aa07f5f3d301de328c1629fc99e667ba474eff355ebe0670bffa5db387d589d2d900ada70ac8069fd2861cc49a6d001722d
SSDEEP

6144:Eud4KJ4hF7popQTRq3va4jl6u31Ut+Ji370HnBs4NeuVCC:O7yUReva4jlNoQnBXek1

Score

10^/10

dridex 10444 botnet

Family

dridex

Botnet

10444

51.75.24.85:443

46.22.116.163:3074

173.249.46.113:3889

192.241.174.45:4443

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5020 wrote to memory of 2356	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 2356	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 2356	5020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bce97f19e31a1e3b783ac32d2c726fa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bce97f19e31a1e3b783ac32d2c726fa_JaffaCakes118.dll,#1
2⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:2800

memory/2356-0-0x0000000074FF0000-0x0000000075041000-memory.dmp

Filesize
324KB

Download
memory/2356-2-0x0000000000DF0000-0x0000000000DF6000-memory.dmp

Filesize
24KB

Download
memory/2356-3-0x0000000074FF0000-0x0000000075041000-memory.dmp

Filesize
324KB

Download