dridex | ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75

Analysis

Target

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
Size

368KB
MD5

f16549beb46741a7ab052173af4c620d
SHA1

b117adde9c307494d83f6e76dacefedee1f73380
SHA256

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75
SHA512

38b5a9852d0895ee8d4df64b3b1824e3accf0458b2eb28a8f162437de30b903fca5ec66627e35b5ade116833b96b99761bb4a8e216e53417a0bcf5a3d809e973

Score

10^/10

Family

dridex

Botnet

10444

210.65.244.176:443

37.34.58.210:6601

77.220.64.141:5037

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1904-5-0x0000000074A80000-0x0000000074ABD000-memory.dmp	dridex_ldr
behavioral1/memory/1904-6-0x0000000074A80000-0x0000000074ABD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1904	528	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75.dll
2⤵
PID:1904

memory/528-2-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/816-8-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmp

Filesize
2.5MB

Download
memory/1904-3-0x0000000000000000-mapping.dmp

Download
memory/1904-4-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1904-5-0x0000000074A80000-0x0000000074ABD000-memory.dmp

Filesize
244KB

Download
memory/1904-6-0x0000000074A80000-0x0000000074ABD000-memory.dmp

Filesize
244KB

Download
memory/1904-7-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download