dridex | 76e86edefabd249e9d0ed7f2ee712d69805effd5cf749cb4d7bf96cacbe70008

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.15942.2214.dll
Size

848KB
MD5

d28a224866d71e2f04236c57de3ea058
SHA1

1ed095b35c48ef0623015d6b4cfc8f182090ec29
SHA256

76e86edefabd249e9d0ed7f2ee712d69805effd5cf749cb4d7bf96cacbe70008
SHA512

186f6e8faa27841c45ee9add074449b18023a45c479bdf09b1c816e5e8e81f87dd2fb6e674f6995c12be885282593ca8d2040f25f72b8e1c10cd3464faf15d81

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1288-5-0x0000000074840000-0x000000007487D000-memory.dmp	dridex_ldr
behavioral1/memory/1288-6-0x0000000074840000-0x000000007487D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1288	1636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.15942.2214.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.15942.2214.dll
2⤵
PID:1288

memory/872-8-0x000007FEF77E0000-0x000007FEF7A5A000-memory.dmp

Filesize
2.5MB

Download
memory/1288-3-0x0000000000000000-mapping.dmp

Download
memory/1288-4-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1288-5-0x0000000074840000-0x000000007487D000-memory.dmp

Filesize
244KB

Download
memory/1288-6-0x0000000074840000-0x000000007487D000-memory.dmp

Filesize
244KB

Download
memory/1288-7-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1636-2-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Filesize
8KB

Download