dridex | b51cf1101bcccd93b318f76c1d5d539f8d43bb7294a9e80e31903d18ee7ca2e1

Analysis

Target
91c6afe0_by_Libranalysis.dll
Size 159KB
Sample210429-sgaskcey2a
SHA256 b51cf1101bcccd93b318f76c1d5d539f8d43bb7294a9e80e31903d18ee7ca2e1
MD5 91c6afe0542ed112fa06099ba1effdbd
SHA1 7d949a88ff4e4eba583746133fbe9b51ec9ee792
SHA512 a4708b58166aa299c668f73931e583038b5de7bdf1d2e383341b11a4a3067403d91ecbcfeee6781200d3c02bf92ba6286b3c082cf4b14ac246afa93a2c085b6c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1648-62-0x0000000010000000-0x000000001002D000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	1648	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1428	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1756 wrote to memory of 1648	1756	rundll32.exe	26
PID 1648 wrote to memory of 1428	1648	rundll32.exe	30
PID 1648 wrote to memory of 1428	1648	rundll32.exe	30
PID 1648 wrote to memory of 1428	1648	rundll32.exe	30
PID 1648 wrote to memory of 1428	1648	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c6afe0_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c6afe0_by_Libranalysis.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 264
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1428

memory/1428-66-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/1648-61-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download

memory/1648-62-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1648-64-0x00000000001A0000-0x00000000001A6000-memory.dmp

Download