dridex | f1b8db9b03a5cb348d275cb285f06f3a224042d333f9eeb283fb6f4e079235d4

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.24817.31701.dll
Size

848KB
MD5

01ec19375d908521de38256dbb91dc47
SHA1

3ba8dfdaa85e58bdc557b58bd6e1cac157a809cd
SHA256

f1b8db9b03a5cb348d275cb285f06f3a224042d333f9eeb283fb6f4e079235d4
SHA512

1d552da86e9144845fcb4871bfd17c22977c301d5484978e45c56dd0c507d338cd03b04d9bce54af6850cb6ba73f2268c99dd6bac224383d8ca8d270be5bf07c

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1216-5-0x00000000742E0000-0x000000007431D000-memory.dmp	dridex_ldr
behavioral1/memory/1216-6-0x00000000742E0000-0x000000007431D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1216	1832	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.24817.31701.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.24817.31701.dll
2⤵
PID:1216

memory/852-8-0x000007FEF7020000-0x000007FEF729A000-memory.dmp

Filesize
2.5MB

Download
memory/1216-3-0x0000000000000000-mapping.dmp

Download
memory/1216-4-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1216-5-0x00000000742E0000-0x000000007431D000-memory.dmp

Filesize
244KB

Download
memory/1216-6-0x00000000742E0000-0x000000007431D000-memory.dmp

Filesize
244KB

Download
memory/1216-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1832-2-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download