dridex | 2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020

Analysis

Target
397b799c357562c5a8061a39514d7785.dll
Size 176KB
Sample210721-fmvd853196
SHA256 2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020
MD5 397b799c357562c5a8061a39514d7785
SHA1 80d3d5366f47d3462ea9e688f444066d7fce2a24
SHA512 bbec10e5d321ee33184cb2b450296103333196e0d9b71c7066bdf6ef5ea011210f6c28ada19532cff1ad22df577e7b40a39b2fa1adabb525b91a1b19e097f70b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/748-115-0x00000000736A0000-0x00000000736D1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	748	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 748	4064	rundll32.exe	71
PID 4064 wrote to memory of 748	4064	rundll32.exe	71
PID 4064 wrote to memory of 748	4064	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\397b799c357562c5a8061a39514d7785.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\397b799c357562c5a8061a39514d7785.dll,#1
  2⤵
  PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2732

memory/748-115-0x00000000736A0000-0x00000000736D1000-memory.dmp

Download

memory/748-117-0x0000000002DE0000-0x0000000002F2A000-memory.dmp

Download