dridex | f5a41c0ca89715b5d7415814349e078d36826f071b1d5e2d8f9fba331f38d70e

Analysis

Target
00fc9479_by_Libranalysis.dll
Size 170KB
Sample210519-4lm7bwlqea
SHA256 f5a41c0ca89715b5d7415814349e078d36826f071b1d5e2d8f9fba331f38d70e
MD5 00fc947988c18f5e371523aa038ba75c
SHA1 68ab84549cbf70f57de49634d5592c4d74560aff
SHA512 3595e9396d45ff07d9799f62277a4448d817bf346b22a54bbd1ef1cc9416404477f1ea0db40c7369cd2b46fde0dda8e5762eb4b7cb9f5aa3100acf2b24588db0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1508 created 1796	1508	WerFault.exe	71

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1796-115-0x0000000073F10000-0x0000000073F3F000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1796	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1796	472	rundll32.exe	71
PID 472 wrote to memory of 1796	472	rundll32.exe	71
PID 472 wrote to memory of 1796	472	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00fc9479_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00fc9479_by_Libranalysis.dll,#1
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 652
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1508

memory/1796-115-0x0000000073F10000-0x0000000073F3F000-memory.dmp

Download

memory/1796-117-0x0000000001040000-0x0000000001063000-memory.dmp

Download