dridex | ec7fd51b4f1816c614055d727d176a6199d7d0fb1efe68befab566578d1a6e32

Analysis

Target
ec7fd51b4f1816c614055d727d176a6199d7d0fb1efe68befab566578d1a6e32.dll
Size 170KB
Sample210616-acyrezvg8x
SHA256 ec7fd51b4f1816c614055d727d176a6199d7d0fb1efe68befab566578d1a6e32
MD5 5ef8b7464abea15d835af3c868619bf8
SHA1 50b38373008d072bf8682135025b4d1d7fdeb44b
SHA512 04bc9ca37c62417f3b0d537092b99bab98e57d99719db16f4ab6f9eab27af6b5925b2064609d98c932d939dff811eeb03c8e27bca043c139dd752948f1db89fd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/3636-115-0x0000000073D70000-0x0000000073DA0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3736	3636	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3636	3256	rundll32.exe	18
PID 3256 wrote to memory of 3636	3256	rundll32.exe	18
PID 3256 wrote to memory of 3636	3256	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec7fd51b4f1816c614055d727d176a6199d7d0fb1efe68befab566578d1a6e32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec7fd51b4f1816c614055d727d176a6199d7d0fb1efe68befab566578d1a6e32.dll,#1
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736

memory/3636-115-0x0000000073D70000-0x0000000073DA0000-memory.dmp

Download

memory/3636-117-0x0000000000520000-0x000000000066A000-memory.dmp

Download