dridex | 85356727cd28577dcf56b7d9f7ef3a6bff832ad29073f12d55ade2654da01636

Analysis

Target
85356727cd28577dcf56b7d9f7ef3a6bff832ad29073f12d55ade2654da01636.dll
Size 172KB
Sample210616-ypfp2avvda
SHA256 85356727cd28577dcf56b7d9f7ef3a6bff832ad29073f12d55ade2654da01636
MD5 486eb2a3be4367558b9a8ba404a93214
SHA1 9bed64338c4c8533f953795ed7893117f31c2e5d
SHA512 de9fbafada7292c03373e7cada770d4b8f6dc02928c3526fe195ba18b9b326474c3cebddc3791a2bfc1b60b03d36ec85585a09d8ef8c16e63481ec1670efac50
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1920-115-0x0000000073660000-0x0000000073690000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	1920	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1920	4008	rundll32.exe	31
PID 4008 wrote to memory of 1920	4008	rundll32.exe	31
PID 4008 wrote to memory of 1920	4008	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85356727cd28577dcf56b7d9f7ef3a6bff832ad29073f12d55ade2654da01636.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85356727cd28577dcf56b7d9f7ef3a6bff832ad29073f12d55ade2654da01636.dll,#1
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3276

memory/1920-115-0x0000000073660000-0x0000000073690000-memory.dmp

Download

memory/1920-117-0x0000000002DD0000-0x0000000002DF3000-memory.dmp

Download