dridex | b6d17901477d586f0814bf353e03542bb8a8c2ccd2e70d335cc9b9118d2b2997

Analysis

Target
b6d17901477d586f0814bf353e03542bb8a8c2ccd2e70d335cc9b9118d2b2997.dll
Size 188KB
Sample210224-a6lfmzwlkx
SHA256 b6d17901477d586f0814bf353e03542bb8a8c2ccd2e70d335cc9b9118d2b2997
MD5 f3d2bcab25a91f585d63b92d21ef5ba6
SHA1 d3afb4bc6e38bec127dc27fd17fd4375f7d9e66b
SHA512 960d6eb270a6f60547bba18145d23652a50b2bcbbe53987927cea5bfa74c3780e7af38a850e126457f4202307bc6fb0c983e13b0170f743e28952bf71876fc5c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1392-3-0x0000000074260000-0x0000000074291000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
184	1392	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1392	640	rundll32.exe	71
PID 640 wrote to memory of 1392	640	rundll32.exe	71
PID 640 wrote to memory of 1392	640	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d17901477d586f0814bf353e03542bb8a8c2ccd2e70d335cc9b9118d2b2997.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d17901477d586f0814bf353e03542bb8a8c2ccd2e70d335cc9b9118d2b2997.dll,#1
  2⤵
  PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 712
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:184

memory/184-5-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download

memory/1392-3-0x0000000074260000-0x0000000074291000-memory.dmp

Download

memory/1392-4-0x0000000003440000-0x0000000003446000-memory.dmp

Download