dridex | 776a4410814e8f901746b6efa728cedca85c15f28c6e5be2f3fb9799c4c802cc

Analysis

Target
776a4410814e8f901746b6efa728cedca85c15f28c6e5be2f3fb9799c4c802cc.dll
Size 172KB
Sample210615-qb2fk2mr4e
SHA256 776a4410814e8f901746b6efa728cedca85c15f28c6e5be2f3fb9799c4c802cc
MD5 8eed041e1f77c340783c69e01d625c7c
SHA1 83cabb5b7e2f7266ccf84ff240ac754d509ebbda
SHA512 1156722c25527ff6e619ee07dce19dc4cc04d5bed3bfa97e2b1eb0c10edc15b3a80cc9d876f577dcdc539e3b5b62888872343203ac95cfb6cfd27209da672fe4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/4636-115-0x0000000074290000-0x00000000742C0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	4636	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4636	4436	rundll32.exe	72
PID 4436 wrote to memory of 4636	4436	rundll32.exe	72
PID 4436 wrote to memory of 4636	4436	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\776a4410814e8f901746b6efa728cedca85c15f28c6e5be2f3fb9799c4c802cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\776a4410814e8f901746b6efa728cedca85c15f28c6e5be2f3fb9799c4c802cc.dll,#1
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

memory/4636-115-0x0000000074290000-0x00000000742C0000-memory.dmp

Download

memory/4636-117-0x0000000002E50000-0x0000000002E73000-memory.dmp

Download