dridex | 55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1

General

Target

adb1d947f0901a4f3cb0b8ad1a6ee385.dll
Size

175KB
MD5

adb1d947f0901a4f3cb0b8ad1a6ee385
SHA1

b82715bbeab52f75dd44f6396593111ae242632c
SHA256

55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1
SHA512

7eea926f405b066917262ad31e109773c40373e6254a25e2b25c53175a8ca7aabc66e275672af38e45eabcd2080f8236078f709ed0332a092cc41b5afea5a606

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1564-62-0x0000000074A40000-0x0000000074A70000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1644 1564 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1644 WerFault.exe
1644 WerFault.exe
1644 WerFault.exe
1644 WerFault.exe
1644 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1644 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1644 WerFault.exe

pid	pid_target	process	target process
1644	1564	WerFault.exe	rundll32.exe

pid	process
1644	WerFault.exe
1644	WerFault.exe
1644	WerFault.exe
1644	WerFault.exe
1644	WerFault.exe

pid	process
1644	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1644	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1564	1672	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1644	1564	rundll32.exe	WerFault.exe
PID 1564 wrote to memory of 1644	1564	rundll32.exe	WerFault.exe
PID 1564 wrote to memory of 1644	1564	rundll32.exe	WerFault.exe
PID 1564 wrote to memory of 1644	1564	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adb1d947f0901a4f3cb0b8ad1a6ee385.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adb1d947f0901a4f3cb0b8ad1a6ee385.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 224
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-60-0x0000000000000000-mapping.dmp

Download
memory/1564-61-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1564-62-0x0000000074A40000-0x0000000074A70000-memory.dmp

Filesize
192KB

Download
memory/1564-65-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download
memory/1644-64-0x0000000000000000-mapping.dmp

Download
memory/1644-66-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing