dridex | a5ffce2a8d98ddc0ccc20744e88443eac323caf1cd8a218b8ccd50bc5ab8f1ac

Analysis

Target

SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll
Size

836KB
MD5

002c56165a0e78369d0e1023ce044bf0
SHA1

78ebfe4167a851bc75d9702aa1aea5efe1514b0c
SHA256

a5ffce2a8d98ddc0ccc20744e88443eac323caf1cd8a218b8ccd50bc5ab8f1ac
SHA512

bb6796d16c54e3521b4207323e7f774f9469d80b7aeb1d270b9f45034dd26ca801d9f8ed5130994ee0c7e35e084b33b7a90e6eef6295be4b53cf77a61c927d2a

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1920-5-0x0000000074670000-0x00000000746AD000-memory.dmp	dridex_ldr
behavioral1/memory/1920-6-0x0000000074670000-0x00000000746AD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 1920	1108	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll
2⤵
PID:1920

memory/1108-2-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1548-8-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1920-3-0x0000000000000000-mapping.dmp

Download
memory/1920-4-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1920-5-0x0000000074670000-0x00000000746AD000-memory.dmp

Filesize
244KB

Download
memory/1920-6-0x0000000074670000-0x00000000746AD000-memory.dmp

Filesize
244KB

Download
memory/1920-7-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download