dridex | 827a50e824419d119d8bbb6f5d30036cb95c298b7931eac387138f57a91c1574

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 11:37

Target

94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe
Size

204KB
MD5

94b2da6df1df4fc542a1c9b71a3a756c
SHA1

4c2f47dd106a10eca3f945ebf0472a7cfedec20a
SHA256

827a50e824419d119d8bbb6f5d30036cb95c298b7931eac387138f57a91c1574
SHA512

25d114fe22441a662ca090be8b15bcab9b5a5117eb68a82e0a56a1c572c3e34253a6058eafef72b947d0ce0df61924f3ff4a65b1e4ec419738575597ef4ecd8f
SSDEEP

1536:0cb8FY3nIlQyneIcy0tvVK7p567zK4nneW5OkHVvQawIvXZRk6b/6FI/hmHkP/Yk:02Abne3yr67uIPHBQawkHrw6hXSNdK

Score

10^/10

Family

dridex

104.236.212.82:443

46.101.162.161:1801

109.73.52.188:3389

185.86.148.222:1801

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

pid process

2276 94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe
2276 94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

description pid process

Token: SeRestorePrivilege 2276 94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

pid	process
2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe
2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

description	pid	process
Token: SeRestorePrivilege	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe

description	pid	process	target process
PID 2276 wrote to memory of 1912	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe	raserver.exe
PID 2276 wrote to memory of 1912	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe	raserver.exe
PID 2276 wrote to memory of 1912	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe	raserver.exe
PID 2276 wrote to memory of 1912	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe	raserver.exe
PID 2276 wrote to memory of 1912	2276	94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\94b2da6df1df4fc542a1c9b71a3a756c_JaffaCakes118.exe"
2⤵
PID:1912

memory/1912-15-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-9-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1912-12-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-14-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-13-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-11-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-16-0x0000000076AA9000-0x0000000076AAA000-memory.dmp

Filesize
4KB

Download
memory/1912-18-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1912-24-0x0000000076A20000-0x0000000076B30000-memory.dmp

Filesize
1.1MB

Download
memory/2276-0-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2276-2-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2276-1-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2276-17-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download