dridex | c2a8f4fcab529f809b7bf59726a480f70d0e3304f1a9947049fdf2b1567a0c47

Analysis

Target

SecuriteInfo.com.Generic.mg.6d5e0ebf3d8c6d2b.30211.dll
Size

836KB
MD5

6d5e0ebf3d8c6d2b88adc17304da36fd
SHA1

d461df26f4017d4cbeecd2c47c3392dd7e442b76
SHA256

c2a8f4fcab529f809b7bf59726a480f70d0e3304f1a9947049fdf2b1567a0c47
SHA512

55ee969fa44aed795acac9073777b0568d944f352340923aad2a027cae2b2d11f0d1a371e3647fd4757ac5723664cb5c880a4b9625b629d49e05c1f5ef1f5225

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/2004-5-0x0000000074210000-0x000000007424D000-memory.dmp	dridex_ldr
behavioral1/memory/2004-6-0x0000000074210000-0x000000007424D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 2004	384	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.6d5e0ebf3d8c6d2b.30211.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.6d5e0ebf3d8c6d2b.30211.dll
2⤵
PID:2004

memory/268-8-0x000007FEF7040000-0x000007FEF72BA000-memory.dmp

Filesize
2.5MB

Download
memory/384-2-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download
memory/2004-3-0x0000000000000000-mapping.dmp

Download
memory/2004-4-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2004-5-0x0000000074210000-0x000000007424D000-memory.dmp

Filesize
244KB

Download
memory/2004-6-0x0000000074210000-0x000000007424D000-memory.dmp

Filesize
244KB

Download
memory/2004-7-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download