dridex | 901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a

Analysis

Target
90feca61ad1a2de0454fc58d93bb5ab6.dll
Size 178KB
Sample210621-b447w6lfqe
SHA256 901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a
MD5 90feca61ad1a2de0454fc58d93bb5ab6
SHA1 f4e5e965dfcbdb5adeb3e172694eaa0bf209198b
SHA512 328bba1691113bddb29847222709075402887532abc5499ce5e88c2a5b369d2085a7dee7bbc1fac9dab19bd8f723a64f6e1f81c928d1286ed432052d8364e6ba
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3656-115-0x00000000736A0000-0x00000000736D1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	3656	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3656	4048	rundll32.exe	69
PID 4048 wrote to memory of 3656	4048	rundll32.exe	69
PID 4048 wrote to memory of 3656	4048	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90feca61ad1a2de0454fc58d93bb5ab6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90feca61ad1a2de0454fc58d93bb5ab6.dll,#1
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 652
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228

memory/3656-115-0x00000000736A0000-0x00000000736D1000-memory.dmp

Download

memory/3656-117-0x00000000028F0000-0x00000000028F6000-memory.dmp

Download