dridex | 13b368bb54cf3314630e9d78bf5e4f2c1e104d3929424c8f413155d916091899

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.27326.7964.dll
Size

848KB
MD5

4b82e27b9770b5354f7b7b254a6c7824
SHA1

30e3892e4da3d5c1bdf2d8fa5cc2772de13af9ab
SHA256

13b368bb54cf3314630e9d78bf5e4f2c1e104d3929424c8f413155d916091899
SHA512

f3859b647bb180f58125b36c3f6b6fcc11041e7b9ff1c149a736356a79830be82d456a6f54381f5fc2eb5e9608e9e16c9706de949be9b6e2769cefe6a14cc790

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1948-5-0x0000000074670000-0x00000000746AD000-memory.dmp	dridex_ldr
behavioral1/memory/1948-6-0x0000000074670000-0x00000000746AD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1948	1784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.27326.7964.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.27326.7964.dll
2⤵
PID:1948

memory/1528-8-0x000007FEF6110000-0x000007FEF638A000-memory.dmp

Filesize
2.5MB

Download
memory/1784-2-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1948-3-0x0000000000000000-mapping.dmp

Download
memory/1948-4-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1948-5-0x0000000074670000-0x00000000746AD000-memory.dmp

Filesize
244KB

Download
memory/1948-6-0x0000000074670000-0x00000000746AD000-memory.dmp

Filesize
244KB

Download
memory/1948-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download