dridex | a25178f738fcc04b6247d4008da0c4fce014fce565d09bf8ae9735427e812904

Analysis

Target

SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll
Size

848KB
MD5

44c2ffce6b6d0000fa0b64b135f15485
SHA1

855bbfb32f1eb41d30fad867eba8e80df15993b7
SHA256

a25178f738fcc04b6247d4008da0c4fce014fce565d09bf8ae9735427e812904
SHA512

56261cbc7936bf0e55acccc725f303d3db4527d1f6137f3aa957a4c02a1b13dd261c7e5a0003aae58df5745589366b52ca3c51817b43477098559244aa1d7fb4

Score

10^/10

Family

dridex

Botnet

10444

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1992-5-0x0000000074900000-0x000000007493D000-memory.dmp	dridex_ldr
behavioral1/memory/1992-6-0x0000000074900000-0x000000007493D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1992	792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.12612.545.dll
2⤵
PID:1992

memory/240-8-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Filesize
2.5MB

Download
memory/792-2-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1992-3-0x0000000000000000-mapping.dmp

Download
memory/1992-4-0x00000000765E1000-0x00000000765E3000-memory.dmp

Filesize
8KB

Download
memory/1992-5-0x0000000074900000-0x000000007493D000-memory.dmp

Filesize
244KB

Download
memory/1992-6-0x0000000074900000-0x000000007493D000-memory.dmp

Filesize
244KB

Download
memory/1992-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download