dridex | 5f714d78dd03257b68bc16c365a1b87c5a661e889f83bed1f2c26c133702bc43

Analysis

Target

SecuriteInfo.com.Generic.mg.3c9afffa30ce6f61.12667.dll
Size

848KB
MD5

3c9afffa30ce6f61103130c2e713036a
SHA1

a139d34f8a9d4bae89248be2ebf03598e2532b1d
SHA256

5f714d78dd03257b68bc16c365a1b87c5a661e889f83bed1f2c26c133702bc43
SHA512

3c42fa35cbb2c0cf1de168a93f4fa1121772851e42a8135f0f4e0ce8e7f451e25c45d6a480c55936f7ebecad33d3b6b90fc69011093be887033bf905c9ac9bb1

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1996-5-0x00000000745B0000-0x00000000745ED000-memory.dmp	dridex_ldr
behavioral1/memory/1996-6-0x00000000745B0000-0x00000000745ED000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1996	784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.3c9afffa30ce6f61.12667.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.3c9afffa30ce6f61.12667.dll
2⤵
PID:1996

memory/784-2-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/1688-8-0x000007FEF6010000-0x000007FEF628A000-memory.dmp

Filesize
2.5MB

Download
memory/1996-3-0x0000000000000000-mapping.dmp

Download
memory/1996-4-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1996-5-0x00000000745B0000-0x00000000745ED000-memory.dmp

Filesize
244KB

Download
memory/1996-6-0x00000000745B0000-0x00000000745ED000-memory.dmp

Filesize
244KB

Download
memory/1996-7-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download