dridex | ac62f7c8450747d339c527566c09739a6b3058a3c84c45e1522cd9368ead68a6

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.30163.3031.dll
Size

848KB
MD5

d947bc88cfcd403bb81ebb17923fa868
SHA1

dc7b6391cb55be0c39b2bfa7e9c2f193f4c6ce69
SHA256

ac62f7c8450747d339c527566c09739a6b3058a3c84c45e1522cd9368ead68a6
SHA512

99e92b10bd0d12f1eab36e17c2fa1e312b8283af4a719cc088eaf46588a014145fe38a9aebf69fc4e6c1c4317acf6be449a8f2c5f8931b10aeae7e511ce36afb

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1468-5-0x0000000074E40000-0x0000000074E7D000-memory.dmp	dridex_ldr
behavioral1/memory/1468-6-0x0000000074E40000-0x0000000074E7D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1468	1052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.30163.3031.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.30163.3031.dll
2⤵
PID:1468

memory/1052-2-0x000007FEFC4C1000-0x000007FEFC4C3000-memory.dmp

Filesize
8KB

Download
memory/1468-3-0x0000000000000000-mapping.dmp

Download
memory/1468-4-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1468-5-0x0000000074E40000-0x0000000074E7D000-memory.dmp

Filesize
244KB

Download
memory/1468-6-0x0000000074E40000-0x0000000074E7D000-memory.dmp

Filesize
244KB

Download
memory/1468-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1744-8-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp

Filesize
2.5MB

Download