dridex | fb5627b02a661062bb9437dbd5acd77d3dec5fa3100b4fcf3e3b41e83df70063

Analysis

Target
fb5627b02a661062bb9437dbd5acd77d3dec5fa3100b4fcf3e3b41e83df70063.dll
Size 188KB
Sample210224-3rd874sg2e
SHA256 fb5627b02a661062bb9437dbd5acd77d3dec5fa3100b4fcf3e3b41e83df70063
MD5 137fbe53a5fafecdc54daf08b63f36ca
SHA1 6c541e9933dd7151fdaac9c82fcfe19ff42e26a2
SHA512 b1169393aa633b41049f55cfe355cd55564caf15916eb5524682215bd0dc8f7876c086fff0a6ca8277eefbe170b085674142af25ca2f89f190c0a104b49b761a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/4712-3-0x0000000075A50000-0x0000000075A81000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	4712	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4712	4696	rundll32.exe	69
PID 4696 wrote to memory of 4712	4696	rundll32.exe	69
PID 4696 wrote to memory of 4712	4696	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5627b02a661062bb9437dbd5acd77d3dec5fa3100b4fcf3e3b41e83df70063.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5627b02a661062bb9437dbd5acd77d3dec5fa3100b4fcf3e3b41e83df70063.dll,#1
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 716
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4072

memory/4072-5-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/4072-6-0x0000000005110000-0x0000000005111000-memory.dmp

Download

memory/4712-3-0x0000000075A50000-0x0000000075A81000-memory.dmp

Download

memory/4712-4-0x00000000004E0000-0x00000000004E6000-memory.dmp

Download