dridex | 864e95d36584e9db7bcd7552272e446a4c7cbc6601dcd4f4a2687d96374b439b

Analysis

Target

x205ymb2n.dll
Size

836KB
MD5

4746fbed409f87ec6ddb6653cb4e201c
SHA1

b8ee3f60f74553e44d42b0f47a0a4a55ed644c97
SHA256

864e95d36584e9db7bcd7552272e446a4c7cbc6601dcd4f4a2687d96374b439b
SHA512

e6def1b637b3aea0d0f4ed27add38e9330e15cda1a38a1dd228799296497ddd0bf13f89022f0491fa98e735b5ccff0f621429a7606d6c3ecb0f57372157b405c

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 3 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1312-3-0x0000000073630000-0x000000007366D000-memory.dmp	dridex_ldr
behavioral2/memory/1312-4-0x0000000073630000-0x000000007366D000-memory.dmp	dridex_ldr
behavioral2/memory/1312-6-0x0000000073630000-0x000000007366D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3300 wrote to memory of 1312	3300	regsvr32.exe	regsvr32.exe
PID 3300 wrote to memory of 1312	3300	regsvr32.exe	regsvr32.exe
PID 3300 wrote to memory of 1312	3300	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x205ymb2n.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\x205ymb2n.dll
2⤵
PID:1312

memory/1312-2-0x0000000000000000-mapping.dmp

Download
memory/1312-3-0x0000000073630000-0x000000007366D000-memory.dmp

Filesize
244KB

Download
memory/1312-4-0x0000000073630000-0x000000007366D000-memory.dmp

Filesize
244KB

Download
memory/1312-5-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1312-6-0x0000000073630000-0x000000007366D000-memory.dmp

Filesize
244KB

Download