dridex | 55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1

Analysis

Target

55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1.dll
Size

175KB
MD5

adb1d947f0901a4f3cb0b8ad1a6ee385
SHA1

b82715bbeab52f75dd44f6396593111ae242632c
SHA256

55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1
SHA512

7eea926f405b066917262ad31e109773c40373e6254a25e2b25c53175a8ca7aabc66e275672af38e45eabcd2080f8236078f709ed0332a092cc41b5afea5a606

Score

10^/10

Family

dridex

Botnet

22201

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/3820-115-0x0000000073B80000-0x0000000073BB0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3540 3820 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3540	3820	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3540 WerFault.exe
Token: SeBackupPrivilege 3540 WerFault.exe
Token: SeDebugPrivilege 3540 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 772 wrote to memory of 3820	772	rundll32.exe	rundll32.exe
PID 772 wrote to memory of 3820	772	rundll32.exe	rundll32.exe
PID 772 wrote to memory of 3820	772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1.dll,#1
  2⤵
  PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 644
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3540

memory/3820-114-0x0000000000000000-mapping.dmp

Download
memory/3820-115-0x0000000073B80000-0x0000000073BB0000-memory.dmp

Filesize
192KB

Download
memory/3820-117-0x0000000000C60000-0x0000000000D0E000-memory.dmp

Filesize
696KB

Download