dridex | 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229

Analysis

Target
c88d3594_by_Libranalysis.dll
Size 161KB
Sample210505-k7htfa3fwe
SHA256 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
MD5 c88d35949162b88018c7cc918e483c9a
SHA1 4a8487bcb011498c171fe995e89ed3f9a557c48c
SHA512 b4295d8a416bc67d52701795730ec981fc3c72747cd36057ac29c5e60c8708e119459981cd0f6197936f76fd36c9d09a8094b0c405024b66a2cd7957460ed20c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1936-62-0x0000000010000000-0x000000001002E000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1936	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1036 wrote to memory of 1936	1036	rundll32.exe	25
PID 1936 wrote to memory of 1696	1936	rundll32.exe	30
PID 1936 wrote to memory of 1696	1936	rundll32.exe	30
PID 1936 wrote to memory of 1696	1936	rundll32.exe	30
PID 1936 wrote to memory of 1696	1936	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c88d3594_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c88d3594_by_Libranalysis.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 264
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1696

memory/1696-66-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/1936-61-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/1936-62-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/1936-64-0x00000000000E0000-0x00000000000E6000-memory.dmp

Download