dridex | 0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159

Analysis

Target
1d8909bf4bad3999a514a46ef7f6edbb.dll
Size 188KB
Sample210702-a7jrtc4a7x
SHA256 0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159
MD5 1d8909bf4bad3999a514a46ef7f6edbb
SHA1 f860e9f35199c5295c78584c6fc9cb817b7a59f5
SHA512 c10b0ae91080106ec790ef5a759277b34803544a4ed7ece24c186e0008758ad2953af3c39e5536572ada77e37c62f9c01d44c0ed274240e17bc2b814b34697ba
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1060-61-0x00000000744C0000-0x00000000744F4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	1060	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 676 wrote to memory of 1060	676	rundll32.exe	27
PID 1060 wrote to memory of 1360	1060	rundll32.exe	30
PID 1060 wrote to memory of 1360	1060	rundll32.exe	30
PID 1060 wrote to memory of 1360	1060	rundll32.exe	30
PID 1060 wrote to memory of 1360	1060	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8909bf4bad3999a514a46ef7f6edbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8909bf4bad3999a514a46ef7f6edbb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1360

memory/1060-60-0x0000000075051000-0x0000000075053000-memory.dmp

Download

memory/1060-61-0x00000000744C0000-0x00000000744F4000-memory.dmp

Download

memory/1060-64-0x00000000000B0000-0x00000000000B6000-memory.dmp

Download

memory/1360-65-0x0000000000480000-0x0000000000481000-memory.dmp

Download