dridex | acc112a0f3d2be5b6fa1b538d9a8fe8a2c5fe73ebd59215d9b3ac5ade9df5168

Analysis

Target
acc112a0f3d2be5b6fa1b538d9a8fe8a2c5fe73ebd59215d9b3ac5ade9df5168.dll
Size 188KB
Sample210224-779qq65dya
SHA256 acc112a0f3d2be5b6fa1b538d9a8fe8a2c5fe73ebd59215d9b3ac5ade9df5168
MD5 0ac2aee17ea363af64a3fa3f499e6e9c
SHA1 b616388ca74a8225597c1dc046b828e334d82e03
SHA512 b6b514cc79534b99c8a34e57b45a0855b72e82b9f007468135bfe9412d077861505d75df1b7973eb17581c0f9a6f98e6c5b69c52a1a33573860ed4308e91e92b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/4024-3-0x0000000073B90000-0x0000000073BC1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	4024	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4024	3496	rundll32.exe	69
PID 3496 wrote to memory of 4024	3496	rundll32.exe	69
PID 3496 wrote to memory of 4024	3496	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc112a0f3d2be5b6fa1b538d9a8fe8a2c5fe73ebd59215d9b3ac5ade9df5168.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc112a0f3d2be5b6fa1b538d9a8fe8a2c5fe73ebd59215d9b3ac5ade9df5168.dll,#1
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 712
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3216

memory/3216-5-0x0000000004720000-0x0000000004721000-memory.dmp

Download

memory/4024-3-0x0000000073B90000-0x0000000073BC1000-memory.dmp

Download

memory/4024-4-0x0000000002DB0000-0x0000000002DB6000-memory.dmp

Download