dridex | 0ff0ed3274fa2251173d9dbb7a62726ae561356fafcd8a3357b3ef394bbf2332

Analysis

Target
6adab184_by_Libranalysis.dll
Size 170KB
Sample210519-fxhphl124n
SHA256 0ff0ed3274fa2251173d9dbb7a62726ae561356fafcd8a3357b3ef394bbf2332
MD5 6adab184c6ee80d1eedeb7d3d46d1ec4
SHA1 ad1ca9380e198f0480008f8869b64e8fcc192e34
SHA512 8c64bc899708aff516412532198ac1e0f19a0b1b55bae8cc3934cc76b5f38a45a6878e422838c9aedd71d49dc1a57b02e5a516aa903e8a6342ad92d9fd9d3325
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3148 created 736	3148	WerFault.exe	69

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/736-115-0x00000000742C0000-0x00000000742EF000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	736	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 736	652	rundll32.exe	69
PID 652 wrote to memory of 736	652	rundll32.exe	69
PID 652 wrote to memory of 736	652	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6adab184_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6adab184_by_Libranalysis.dll,#1
  2⤵
  PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 648
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

memory/736-115-0x00000000742C0000-0x00000000742EF000-memory.dmp

Download

memory/736-117-0x0000000000280000-0x000000000032E000-memory.dmp

Download