dridex | 0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159

Analysis

Target
1d8909bf4bad3999a514a46ef7f6edbb.dll
Size 188KB
Sample210702-a7jrtc4a7x
SHA256 0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159
MD5 1d8909bf4bad3999a514a46ef7f6edbb
SHA1 f860e9f35199c5295c78584c6fc9cb817b7a59f5
SHA512 c10b0ae91080106ec790ef5a759277b34803544a4ed7ece24c186e0008758ad2953af3c39e5536572ada77e37c62f9c01d44c0ed274240e17bc2b814b34697ba
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1248-115-0x0000000073A80000-0x0000000073AB4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3284	1248	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 1248	512	rundll32.exe	67
PID 512 wrote to memory of 1248	512	rundll32.exe	67
PID 512 wrote to memory of 1248	512	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8909bf4bad3999a514a46ef7f6edbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8909bf4bad3999a514a46ef7f6edbb.dll,#1
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 640
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3284

memory/1248-115-0x0000000073A80000-0x0000000073AB4000-memory.dmp

Download

memory/1248-117-0x0000000000DF0000-0x0000000000DF6000-memory.dmp

Download