dridex | af47bed31dccde8b7f61405facf49ac172e7a58af7449e53373166b58cc6052f

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.17436.18814.dll
Size

848KB
MD5

054163a5c03b3729bef9f9dd63ff7945
SHA1

6eccd0c7a2e7519f083ad9ee14dcbf97f02e7748
SHA256

af47bed31dccde8b7f61405facf49ac172e7a58af7449e53373166b58cc6052f
SHA512

d764c583f1c159fa305c72c8c0c40c6a15ca74818d7cb3cd0e4d51eae5922544be5780dd29ad19cfde91bf248aa8b36feda842cf4f4ee450cb4e029d33ad3665

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/2000-5-0x0000000074860000-0x000000007489D000-memory.dmp	dridex_ldr
behavioral1/memory/2000-6-0x0000000074860000-0x000000007489D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 2000	1652	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.17436.18814.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.17436.18814.dll
2⤵
PID:2000

memory/652-8-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp

Filesize
2.5MB

Download
memory/1652-2-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/2000-3-0x0000000000000000-mapping.dmp

Download
memory/2000-4-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/2000-5-0x0000000074860000-0x000000007489D000-memory.dmp

Filesize
244KB

Download
memory/2000-6-0x0000000074860000-0x000000007489D000-memory.dmp

Filesize
244KB

Download
memory/2000-7-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download