dridex | 06bc964eadf4037350c1636d2a1ba940e4241708df9e3e0ea31a9c401174a03c

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.27526.18192.dll
Size

848KB
MD5

aa059dfb1f059bb606d6a33595db2a97
SHA1

329bb94f42112d51efaa927026904028428199fc
SHA256

06bc964eadf4037350c1636d2a1ba940e4241708df9e3e0ea31a9c401174a03c
SHA512

356be79de6e6a1c987a4732d99f6f62f6acca1e804fc4bdbc57a67c488ae1d38fecf757f2b1b39c0ca7ab2fa348c6a4328b472fd9f6ee17a9d679161fd37dbc5

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1192-5-0x0000000074270000-0x00000000742AD000-memory.dmp	dridex_ldr
behavioral1/memory/1192-6-0x0000000074270000-0x00000000742AD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 1192	1668	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.27526.18192.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.27526.18192.dll
2⤵
PID:1192

memory/1192-3-0x0000000000000000-mapping.dmp

Download
memory/1192-4-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/1192-5-0x0000000074270000-0x00000000742AD000-memory.dmp

Filesize
244KB

Download
memory/1192-6-0x0000000074270000-0x00000000742AD000-memory.dmp

Filesize
244KB

Download
memory/1192-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1664-8-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download
memory/1668-2-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download