dridex | df71bb502e838c9732ebcaf083b4781958ffa3fa4ad5052c463c4a0e6970523c

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 00:16

Target

96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe
Size

204KB
MD5

96bbc5a1c87406d3811a0fbdaa6a5800
SHA1

9fd201c1b94ee62c04239939bc9dfc053a41bf02
SHA256

df71bb502e838c9732ebcaf083b4781958ffa3fa4ad5052c463c4a0e6970523c
SHA512

356a0597c8cb63b980ceb112a5bfffcb80c636ec2625ec6b24a4468c226a024009841a29edea5d7be7cbd7d0384f9d77881caf614a5a3cf9183c21f5ba198e50
SSDEEP

1536:r5xYwjU1FRIcRW2oJkw4HU2nI+Ta+v7iawLRZFfHPe/h/5DH04NumpC9dQpF+k2i:rfVAOcNWDtPeDoCumpC7QpF+5yW27o2

Score

10^/10

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

pid	process
2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe
2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe
2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe
2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

description pid process

Token: SeRestorePrivilege 2968 96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

description	pid	process
Token: SeRestorePrivilege	2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe

description	pid	process	target process
PID 2968 wrote to memory of 1228	2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe	raserver.exe
PID 2968 wrote to memory of 1228	2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe	raserver.exe
PID 2968 wrote to memory of 1228	2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe	raserver.exe
PID 2968 wrote to memory of 1228	2968	96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\96bbc5a1c87406d3811a0fbdaa6a5800_JaffaCakes118.exe"
2⤵
PID:1228

memory/1228-13-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1228-12-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1228-25-0x00000000759B0000-0x0000000075AA0000-memory.dmp

Filesize
960KB

Download
memory/1228-14-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1228-17-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1228-23-0x0000000075A02000-0x0000000075A03000-memory.dmp

Filesize
4KB

Download
memory/1228-24-0x00000000759B0000-0x0000000075AA0000-memory.dmp

Filesize
960KB

Download
memory/1228-11-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1228-9-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1228-15-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2968-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2968-0-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2968-16-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2968-2-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download