dridex | 3324da18d8d14d4dff166e4af1a8922f177dd675c3a69c266bd4b297ff1f4039

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll
Size

848KB
MD5

f9c2f9623ef10ab7afa11cc2243b3261
SHA1

e4d8806381f95f0fab57f23e52120a0948912c67
SHA256

3324da18d8d14d4dff166e4af1a8922f177dd675c3a69c266bd4b297ff1f4039
SHA512

8eada9ca845dff3a91c5c238319b4bbd1a6ab03d89d61bbfd863bd66c1b18af7a2fc1a3ea87b4b590d5d23882cce92278a8bdc4b1748de9a8989519589032032

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/2044-5-0x00000000745A0000-0x00000000745DD000-memory.dmp	dridex_ldr
behavioral1/memory/2044-6-0x00000000745A0000-0x00000000745DD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 2044	1812	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll
2⤵
PID:2044

memory/1468-8-0x000007FEF6100000-0x000007FEF637A000-memory.dmp

Filesize
2.5MB

Download
memory/1812-2-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/2044-3-0x0000000000000000-mapping.dmp

Download
memory/2044-4-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/2044-5-0x00000000745A0000-0x00000000745DD000-memory.dmp

Filesize
244KB

Download
memory/2044-6-0x00000000745A0000-0x00000000745DD000-memory.dmp

Filesize
244KB

Download
memory/2044-7-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download