dridex | f02daa7dc041b9166371cc8f76de01f90bb3bee82ee8236fc9a113eb7a80f878

Analysis

Target

SecuriteInfo.com.Generic.mg.a044b05b562df10c.24500.dll
Size

836KB
MD5

a044b05b562df10c84f801613a67a8db
SHA1

778e906286b670d5c65f409a19c22551c7cf638f
SHA256

f02daa7dc041b9166371cc8f76de01f90bb3bee82ee8236fc9a113eb7a80f878
SHA512

e262b412ac01c75ea1ca0df9c5af9a19d1103cb7ae0ddd4d514a7a28d05a3c6d3a00e576a9d0e4b816b8f79f8f1fabd6cede7f6ac9bc580114e939190eadb3c8

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1288-5-0x0000000074840000-0x000000007487D000-memory.dmp	dridex_ldr
behavioral1/memory/1288-6-0x0000000074840000-0x000000007487D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.a044b05b562df10c.24500.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.a044b05b562df10c.24500.dll
2⤵
PID:1288

memory/780-8-0x000007FEF6380000-0x000007FEF65FA000-memory.dmp

Filesize
2.5MB

Download
memory/1288-3-0x0000000000000000-mapping.dmp

Download
memory/1288-4-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1288-5-0x0000000074840000-0x000000007487D000-memory.dmp

Filesize
244KB

Download
memory/1288-6-0x0000000074840000-0x000000007487D000-memory.dmp

Filesize
244KB

Download
memory/1288-7-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1636-2-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Filesize
8KB

Download