dridex | b51cf1101bcccd93b318f76c1d5d539f8d43bb7294a9e80e31903d18ee7ca2e1

Analysis

Target
91c6afe0_by_Libranalysis.dll
Size 159KB
Sample210429-sgaskcey2a
SHA256 b51cf1101bcccd93b318f76c1d5d539f8d43bb7294a9e80e31903d18ee7ca2e1
MD5 91c6afe0542ed112fa06099ba1effdbd
SHA1 7d949a88ff4e4eba583746133fbe9b51ec9ee792
SHA512 a4708b58166aa299c668f73931e583038b5de7bdf1d2e383341b11a4a3067403d91ecbcfeee6781200d3c02bf92ba6286b3c082cf4b14ac246afa93a2c085b6c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3996-115-0x0000000010000000-0x000000001002D000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	3996	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 3996	660	rundll32.exe	70
PID 660 wrote to memory of 3996	660	rundll32.exe	70
PID 660 wrote to memory of 3996	660	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c6afe0_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c6afe0_by_Libranalysis.dll,#1
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 720
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216

memory/3996-115-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/3996-117-0x0000000003450000-0x0000000003456000-memory.dmp

Download