dridex | 58242c08ab978824f9ebbe4fb48a80dde5c7e59d0489caf73328a7eec599415c

Analysis

Target
zsjm5zv7kjpg.dll
Size 577KB
Sample200930-px7ckrf62s
SHA256 58242c08ab978824f9ebbe4fb48a80dde5c7e59d0489caf73328a7eec599415c
MD5 206803daf8a8c1459c8d597e5250b993
SHA1 5905e986acf1effcdc223f842aafc09ec77d0d73
SHA512 f774de45b5fb8de8ee26bd0f20600d4605c4770669b34e752a30d668922678ad4f939ad2db2962843d773a0ef41431c203e2a680c8edd73f35a56f61141009f8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/548-2-0x0000000000000000-mapping.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	548	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 548	3980	rundll32.exe	69
PID 3980 wrote to memory of 548	3980	rundll32.exe	69
PID 3980 wrote to memory of 548	3980	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zsjm5zv7kjpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zsjm5zv7kjpg.dll,#1
  2⤵
  PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1892

memory/1892-1-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download

memory/1892-3-0x0000000005300000-0x0000000005301000-memory.dmp

Download