dridex | 78c59eaa8e0e6505756c4ac49585011355def41c94dd70cb2b1a62845cdfdd60

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.4309.6501.dll
Size

848KB
MD5

f778fdf0a77cadcfc841b8fd0a42cf77
SHA1

1343289fdc32779c8b94d59536f9880935365694
SHA256

78c59eaa8e0e6505756c4ac49585011355def41c94dd70cb2b1a62845cdfdd60
SHA512

bd559d0ee82310aba91741b52eab10ae1c12951bcd10d58cebd4a52bb7d79159326fd1606157cca4ce36ea3922110d8897a100789ca4a8be553eacb72ed1044c

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1904-5-0x0000000074970000-0x00000000749AD000-memory.dmp	dridex_ldr
behavioral1/memory/1904-6-0x0000000074970000-0x00000000749AD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1904	308	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.4309.6501.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.4309.6501.dll
2⤵
PID:1904

memory/308-2-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1344-8-0x000007FEF6400000-0x000007FEF667A000-memory.dmp

Filesize
2.5MB

Download
memory/1904-3-0x0000000000000000-mapping.dmp

Download
memory/1904-4-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1904-5-0x0000000074970000-0x00000000749AD000-memory.dmp

Filesize
244KB

Download
memory/1904-6-0x0000000074970000-0x00000000749AD000-memory.dmp

Filesize
244KB

Download
memory/1904-7-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download