dridex | 629cc44e4938a30920553563cb86ea033914aa19998749fb8a4b5e80ecd85e1d

Analysis

Target
629cc44e4938a30920553563cb86ea033914aa19998749fb8a4b5e80ecd85e1d.dll
Size 188KB
Sample210224-bpd3lgtlp2
SHA256 629cc44e4938a30920553563cb86ea033914aa19998749fb8a4b5e80ecd85e1d
MD5 ecd02387443867ded214110c1a2869c4
SHA1 38f189aff06f6aed2ff39bf2b068da7efcc6c25e
SHA512 3e58ade315f5fec2586d94313f093f683f481b044e5a76d1bf05eddfacba7b3744f652a2506d59d7302d206173facc89ec7e0b0529fa99423a3ffd7c7f6f28ce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/736-3-0x0000000074000000-0x0000000074031000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	736	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 736	3928	rundll32.exe	71
PID 3928 wrote to memory of 736	3928	rundll32.exe	71
PID 3928 wrote to memory of 736	3928	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cc44e4938a30920553563cb86ea033914aa19998749fb8a4b5e80ecd85e1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cc44e4938a30920553563cb86ea033914aa19998749fb8a4b5e80ecd85e1d.dll,#1
  2⤵
  PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 712
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2988

memory/736-3-0x0000000074000000-0x0000000074031000-memory.dmp

Download

memory/736-4-0x00000000024A0000-0x00000000024A6000-memory.dmp

Download

memory/2988-5-0x00000000041F0000-0x00000000041F1000-memory.dmp

Download