dridex | ae0d704631bde00d8a404a142eac77f724d5f824efae359bd97b3731c56b5ff2

Analysis

Target
8652d84a_by_Libranalysis.dll
Size 162KB
Sample210510-tpdr9ndp86
SHA256 ae0d704631bde00d8a404a142eac77f724d5f824efae359bd97b3731c56b5ff2
MD5 8652d84ae3d36f8804f741a8fb216e88
SHA1 bea74219b4471c965737232b061a495b29cada50
SHA512 39377787d5354ad6b88f84857ef6cc78c0d2ca0659d73cff27eb1a4eaca368cdcb80b5430a727cab0def398978d21778646f51cd38c17e9b0f8bed00ae720508
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2144-115-0x0000000010000000-0x000000001002D000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2144	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2144	3968	rundll32.exe	29
PID 3968 wrote to memory of 2144	3968	rundll32.exe	29
PID 3968 wrote to memory of 2144	3968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8652d84a_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8652d84a_by_Libranalysis.dll,#1
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 720
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2176

memory/2144-115-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/2144-117-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

Download