dridex | 31bea27a340c3e0ee5a7d45b0dd2f59cbe2bdbc56ed73439d8416c24cc5121ae

Analysis

Target
31bea27a340c3e0ee5a7d45b0dd2f59cbe2bdbc56ed73439d8416c24cc5121ae.dll
Size 170KB
Sample210615-4ll7ay5mys
SHA256 31bea27a340c3e0ee5a7d45b0dd2f59cbe2bdbc56ed73439d8416c24cc5121ae
MD5 021a3655184be8d42d6dd0aba9ab79b4
SHA1 9324acfd25516ccbcd9d98db4f434112265be3f1
SHA512 e0cce50dd203c97b93b4224659af31794de71e7b08974342e4e191aac4aa65c99c5343b094adc0ba4baa44484a7db4dc1ec85682a8ed8ad64f8524ecf1f7f976
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/3960-115-0x00000000742E0000-0x0000000074310000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	3960	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3960	4080	rundll32.exe	69
PID 4080 wrote to memory of 3960	4080	rundll32.exe	69
PID 4080 wrote to memory of 3960	4080	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31bea27a340c3e0ee5a7d45b0dd2f59cbe2bdbc56ed73439d8416c24cc5121ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31bea27a340c3e0ee5a7d45b0dd2f59cbe2bdbc56ed73439d8416c24cc5121ae.dll,#1
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1196

memory/3960-115-0x00000000742E0000-0x0000000074310000-memory.dmp

Download

memory/3960-117-0x0000000002B00000-0x0000000002B06000-memory.dmp

Download