dridex | 8f5746f816173991ffdab4db119462826fd891d520584433e2c3fefaee6e5c3d

Analysis

Target

8f5746f816173991ffdab4db119462826fd891d520584433e2c3fefaee6e5c3d.dll
Size

174KB
MD5

03721a77b6fc1d740ef53372849215d1
SHA1

8f7f9311d8109bb8a9f39b9ce00c7d532a1fbf27
SHA256

8f5746f816173991ffdab4db119462826fd891d520584433e2c3fefaee6e5c3d
SHA512

441e475227a426800a4a96c36fbf74f6192b57a1e0447397a32474300da5ec6d9ed8afcef88cf79c12e0c85fc5f5daf8da45fb809bad7754f1ade8c284b6bc0e

Score

10^/10

Family

dridex

Botnet

22201

178.128.220.64:30333

45.79.91.89:9987

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/64-115-0x0000000073A90000-0x0000000073AC0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3288 64 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3288	64	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3288 WerFault.exe
Token: SeBackupPrivilege 3288 WerFault.exe
Token: SeDebugPrivilege 3288 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 512 wrote to memory of 64	512	rundll32.exe	rundll32.exe
PID 512 wrote to memory of 64	512	rundll32.exe	rundll32.exe
PID 512 wrote to memory of 64	512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5746f816173991ffdab4db119462826fd891d520584433e2c3fefaee6e5c3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5746f816173991ffdab4db119462826fd891d520584433e2c3fefaee6e5c3d.dll,#1
  2⤵
  PID:64
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 648
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3288

memory/64-114-0x0000000000000000-mapping.dmp

Download
memory/64-115-0x0000000073A90000-0x0000000073AC0000-memory.dmp

Filesize
192KB

Download
memory/64-117-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download