dridex | 4b8270b92392f19713dc0e0397765d102b478fc8343699c3a6bcf0a339a07713

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:58

Target

88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe
Size

204KB
MD5

88a67df65a4150117d6010dc1160f07c
SHA1

178a5ec8894d9260d9d11b3ec0f9ad04327b290d
SHA256

4b8270b92392f19713dc0e0397765d102b478fc8343699c3a6bcf0a339a07713
SHA512

25d693eeb2fe665403cefdadd89c51d08271bb02db42641d4e3bcfeedb1b3cf64437c31083a332c877a11f435be0e097da0a09526fe24f62e69b7c574689fe77
SSDEEP

1536:K5xYwjU1FRIcRW2oJkw4HU2nI+Ta+v7iawLRZFfHPe/h/5DH04Numpa9dQpF+k2i:KfVAOcNWDtPeDoCumpa7QpF+5yW27o2

Score

10^/10

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe

description pid process

Token: SeRestorePrivilege 3936 88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe

description	pid	process
Token: SeRestorePrivilege	3936	88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe

description	pid	process	target process
PID 3936 wrote to memory of 2960	3936	88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe	raserver.exe
PID 3936 wrote to memory of 2960	3936	88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe	raserver.exe
PID 3936 wrote to memory of 2960	3936	88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe	raserver.exe
PID 3936 wrote to memory of 2960	3936	88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\88a67df65a4150117d6010dc1160f07c_JaffaCakes118.exe"
2⤵
PID:2960

memory/2960-24-0x0000000075C30000-0x0000000075D20000-memory.dmp

Filesize
960KB

Download
memory/2960-16-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2960-25-0x0000000075C30000-0x0000000075D20000-memory.dmp

Filesize
960KB

Download
memory/2960-12-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2960-15-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2960-9-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2960-11-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2960-23-0x0000000075C82000-0x0000000075C83000-memory.dmp

Filesize
4KB

Download
memory/2960-13-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2960-14-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3936-1-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3936-0-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3936-22-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3936-2-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download