dridex | 290f0951bcc2bac169e0218bdebbf7e1669e024ad3c09ce049783cfda1aac047

Analysis

Target
290f0951bcc2bac169e0218bdebbf7e1669e024ad3c09ce049783cfda1aac047.dll
Size 172KB
Sample210615-49kbrvtxjs
SHA256 290f0951bcc2bac169e0218bdebbf7e1669e024ad3c09ce049783cfda1aac047
MD5 f4d2e3f3d7c9669c151b98cc0b8a7f70
SHA1 83a74ab64cdef808b21993473386c68874066807
SHA512 277bfe53b5f8d94fed0a69f502d62780ac1a631bb3d111a971762e65318175f9bddfeea3f5ca2a87440a805f780bdff840460f05f41500654312a3dff55eac74
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/476-115-0x00000000739B0000-0x00000000739E0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3116	476	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 476	1808	rundll32.exe	69
PID 1808 wrote to memory of 476	1808	rundll32.exe	69
PID 1808 wrote to memory of 476	1808	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\290f0951bcc2bac169e0218bdebbf7e1669e024ad3c09ce049783cfda1aac047.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\290f0951bcc2bac169e0218bdebbf7e1669e024ad3c09ce049783cfda1aac047.dll,#1
  2⤵
  PID:476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3116

memory/476-115-0x00000000739B0000-0x00000000739E0000-memory.dmp

Download

memory/476-117-0x0000000003200000-0x00000000032AE000-memory.dmp

Download