dridex | 9e0372e20c72f1e62bdb3f8bb4d1c9a54269b3b10ec6a6a0deb151a250cc03ff

Analysis

Target

9e0372e20c72f1e62bdb3f8bb4d1c9a54269b3b10ec6a6a0deb151a250cc03ff.dll
Size

172KB
MD5

bb86cca33d7c5ce72231f349e53631a9
SHA1

f36c89e21e711f1c78fa5de5d8490ddc1c23fc4f
SHA256

9e0372e20c72f1e62bdb3f8bb4d1c9a54269b3b10ec6a6a0deb151a250cc03ff
SHA512

ad5d0975c108e6fe6b420b32a907ed6626375176b64eb6e09a60a331410a20bf7f129e11d7a2d5ee0a8e082e5850e4eac92565a631d174dd71a29c755dae78d0

Score

10^/10

Family

dridex

Botnet

40112

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/3196-115-0x00000000739D0000-0x0000000073A00000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 3196 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1208	3196	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1208 WerFault.exe
Token: SeBackupPrivilege 1208 WerFault.exe
Token: SeDebugPrivilege 1208 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1736 wrote to memory of 3196	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 3196	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 3196	1736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e0372e20c72f1e62bdb3f8bb4d1c9a54269b3b10ec6a6a0deb151a250cc03ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e0372e20c72f1e62bdb3f8bb4d1c9a54269b3b10ec6a6a0deb151a250cc03ff.dll,#1
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1208

memory/3196-114-0x0000000000000000-mapping.dmp

Download
memory/3196-115-0x00000000739D0000-0x0000000073A00000-memory.dmp

Filesize
192KB

Download
memory/3196-117-0x0000000000B40000-0x0000000000B63000-memory.dmp

Filesize
140KB

Download