dridex | 0d33d4120d131f9e27a3fd89d91c94bf42f80fdab05b6812909b4a05a94e815c

Analysis

Target
0d33d4120d131f9e27a3fd89d91c94bf42f80fdab05b6812909b4a05a94e815c.dll
Size 170KB
Sample210615-cnnflta89a
SHA256 0d33d4120d131f9e27a3fd89d91c94bf42f80fdab05b6812909b4a05a94e815c
MD5 711ac5a983e895f4336e85e83a9810e0
SHA1 d0eee1fd8bb212d4ac2b5abfddce970b8948ad35
SHA512 428d2bc1ba985008936881b018da55a42fbb2904a4c3da76d5011d23fb56e8103c1ceb49b317cb20cbf2f8f7ffa04f8181f3b48defcaf1e20899202b73dadc8e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/3936-115-0x0000000074090000-0x00000000740C0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	3936	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3936	3952	rundll32.exe	68
PID 3952 wrote to memory of 3936	3952	rundll32.exe	68
PID 3952 wrote to memory of 3936	3952	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d33d4120d131f9e27a3fd89d91c94bf42f80fdab05b6812909b4a05a94e815c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d33d4120d131f9e27a3fd89d91c94bf42f80fdab05b6812909b4a05a94e815c.dll,#1
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 676
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3452

memory/3936-115-0x0000000074090000-0x00000000740C0000-memory.dmp

Download

memory/3936-117-0x00000000035B0000-0x00000000035B6000-memory.dmp

Download