dridex | b20de664d7a820ab27453abab174d9b729ed67d4a0231b3442b08843407b8449

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 14:24

Target

b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe
Size

204KB
MD5

b3f85c5f1373e3d209d3bf12c5d22603
SHA1

13216e452726b342b372aa51468342242fd0f5a4
SHA256

b20de664d7a820ab27453abab174d9b729ed67d4a0231b3442b08843407b8449
SHA512

dc7deae21878b878a86d2105a5db06bcc54fa8face43a37e0f3ec8d6ff1db9676bf1009e1514443286eb716f84164ef2d6989525f1f481e6b68fbefc3a63d6ca
SSDEEP

1536:x5xYwjU1FRIcRW2oJkw4HU2nI+Ta+v7iawLRZFfHPe/h/5DH04NumpW9dQpF+k2i:xfVAOcNWDtPeDoCumpW7QpF+5yW27o2

Score

10^/10

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

pid process

2208 b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe
2208 b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

description pid process

Token: SeRestorePrivilege 2208 b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

pid	process
2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe
2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

description	pid	process
Token: SeRestorePrivilege	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe

description	pid	process	target process
PID 2208 wrote to memory of 2232	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe	raserver.exe
PID 2208 wrote to memory of 2232	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe	raserver.exe
PID 2208 wrote to memory of 2232	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe	raserver.exe
PID 2208 wrote to memory of 2232	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe	raserver.exe
PID 2208 wrote to memory of 2232	2208	b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\b3f85c5f1373e3d209d3bf12c5d22603_JaffaCakes118.exe"
2⤵
PID:2232

memory/2208-16-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2208-0-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2208-2-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2208-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2232-9-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2232-17-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-11-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-15-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-14-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-13-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-23-0x00000000755C9000-0x00000000755CA000-memory.dmp

Filesize
4KB

Download
memory/2232-12-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2232-24-0x0000000075540000-0x0000000075650000-memory.dmp

Filesize
1.1MB

Download