dridex | 5908a1e548ba0c94e9bac5712a2abaa26b334455362bcc418a503747659afea0

Analysis

Score

10^/10

Family

dridex

Botnet

10555

185.59.223.86:443

123.231.252.10:4646

85.25.109.116:3889

91.83.93.89:4643

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/3196-3-0x0000000003010000-0x000000000304D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 796 wrote to memory of 3196	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 3196	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 3196	796	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxtvys[1].rar.dll,#1
1⤵
PID:3196

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxtvys[1].rar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796

memory/3196-2-0x0000000000000000-mapping.dmp

Download
memory/3196-3-0x0000000003010000-0x000000000304D000-memory.dmp

Filesize
244KB

Download