dridex | bf3e1ea7333396e14b3c521e898a2d0e9c884e850ed0348d252ca1814ade86ae

Analysis

Target
bf3e1ea7333396e14b3c521e898a2d0e9c884e850ed0348d252ca1814ade86ae.dll
Size 188KB
Sample210224-1jp1hfthss
SHA256 bf3e1ea7333396e14b3c521e898a2d0e9c884e850ed0348d252ca1814ade86ae
MD5 c27272fc894c031b58490536a90ae572
SHA1 1fe5cdccb0d593c8d95bde14b141b101fc5cca82
SHA512 b790d546b42c14687439a4600fb15fb58eb3d30e04a2a11a3aee4dc5f61a1b6723df6904618af53f95647844a5e3c41083f8b00073b285cc3cd2433c76928c33
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3636-3-0x0000000074260000-0x0000000074291000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3636	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3636	4068	rundll32.exe	69
PID 4068 wrote to memory of 3636	4068	rundll32.exe	69
PID 4068 wrote to memory of 3636	4068	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3e1ea7333396e14b3c521e898a2d0e9c884e850ed0348d252ca1814ade86ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3e1ea7333396e14b3c521e898a2d0e9c884e850ed0348d252ca1814ade86ae.dll,#1
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 712
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860

memory/3636-3-0x0000000074260000-0x0000000074291000-memory.dmp

Download

memory/3636-4-0x00000000023F0000-0x00000000023F6000-memory.dmp

Download

memory/3860-5-0x00000000043F0000-0x00000000043F1000-memory.dmp

Download