dridex | 91086037b3404f602bb1ab023a4cacb6a8e541b7ea23c5fe7275a01d7add3fdd

Analysis

Target
91086037b3404f602bb1ab023a4cacb6a8e541b7ea23c5fe7275a01d7add3fdd.dll
Size 170KB
Sample210615-7cnw59sdvx
SHA256 91086037b3404f602bb1ab023a4cacb6a8e541b7ea23c5fe7275a01d7add3fdd
MD5 1a8b9fe40de5d5174d388bd3666a9f8b
SHA1 149e9288c1462994ff5a268117c9df0cf275faf6
SHA512 8ba3fd1f0520d156d1a319b851674f1b032287ba226d5432fddb06af384361d4590bf7423836dc96009fef58657e5647bbb00f710852ed8705bddf6bae428acf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1520-115-0x0000000074310000-0x0000000074340000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1520	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1520	3164	rundll32.exe	71
PID 3164 wrote to memory of 1520	3164	rundll32.exe	71
PID 3164 wrote to memory of 1520	3164	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91086037b3404f602bb1ab023a4cacb6a8e541b7ea23c5fe7275a01d7add3fdd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91086037b3404f602bb1ab023a4cacb6a8e541b7ea23c5fe7275a01d7add3fdd.dll,#1
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2176

memory/1520-115-0x0000000074310000-0x0000000074340000-memory.dmp

Download

memory/1520-117-0x0000000004850000-0x0000000004873000-memory.dmp

Download