dridex | f3e3749dc20de17ac7dc81660287e205b35811fcc497701e2eb291dffb578352

Analysis

Target
f3e3749dc20de17ac7dc81660287e205b35811fcc497701e2eb291dffb578352.dll
Size 172KB
Sample210615-e8try9kdqj
SHA256 f3e3749dc20de17ac7dc81660287e205b35811fcc497701e2eb291dffb578352
MD5 c767c0dc39eae10fea68b0e045bd9990
SHA1 c3904832594a593a2c53f8fd35b57c8e9f005b10
SHA512 b6a19a5c8c16e89f84457446abe6b9b5538c91f52366452bb990c4c759f48bca7df09f0ee153458e7498bf6a7f0acd1bdd252e7e844369a971341217bdaedb1f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1972-115-0x0000000073660000-0x0000000073690000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1972	WerFault.exe	38

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 1972	4012	rundll32.exe	38
PID 4012 wrote to memory of 1972	4012	rundll32.exe	38
PID 4012 wrote to memory of 1972	4012	rundll32.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3e3749dc20de17ac7dc81660287e205b35811fcc497701e2eb291dffb578352.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3e3749dc20de17ac7dc81660287e205b35811fcc497701e2eb291dffb578352.dll,#1
  2⤵
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 676
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820

memory/1972-115-0x0000000073660000-0x0000000073690000-memory.dmp

Download

memory/1972-117-0x00000000007F0000-0x00000000007F6000-memory.dmp

Download