dridex | 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229

Analysis

Target
c88d3594_by_Libranalysis.dll
Size 161KB
Sample210505-k7htfa3fwe
SHA256 41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229
MD5 c88d35949162b88018c7cc918e483c9a
SHA1 4a8487bcb011498c171fe995e89ed3f9a557c48c
SHA512 b4295d8a416bc67d52701795730ec981fc3c72747cd36057ac29c5e60c8708e119459981cd0f6197936f76fd36c9d09a8094b0c405024b66a2cd7957460ed20c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3928-115-0x0000000010000000-0x000000001002E000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	3928	WerFault.exe	34

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 3928	3156	rundll32.exe	34
PID 3156 wrote to memory of 3928	3156	rundll32.exe	34
PID 3156 wrote to memory of 3928	3156	rundll32.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c88d3594_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c88d3594_by_Libranalysis.dll,#1
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120

memory/3928-115-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/3928-117-0x0000000003210000-0x0000000003216000-memory.dmp

Download