dridex | 55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1

Analysis

Target

adb1d947f0901a4f3cb0b8ad1a6ee385.dll
Size

175KB
MD5

adb1d947f0901a4f3cb0b8ad1a6ee385
SHA1

b82715bbeab52f75dd44f6396593111ae242632c
SHA256

55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1
SHA512

7eea926f405b066917262ad31e109773c40373e6254a25e2b25c53175a8ca7aabc66e275672af38e45eabcd2080f8236078f709ed0332a092cc41b5afea5a606

Score

10^/10

Family

dridex

Botnet

22201

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1320-115-0x0000000074440000-0x0000000074470000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

936 1320 WerFault.exe rundll32.exe

pid	pid_target	process	target process
936	1320	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 936 WerFault.exe
Token: SeBackupPrivilege 936 WerFault.exe
Token: SeDebugPrivilege 936 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 656 wrote to memory of 1320	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1320	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1320	656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adb1d947f0901a4f3cb0b8ad1a6ee385.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adb1d947f0901a4f3cb0b8ad1a6ee385.dll,#1
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:936

memory/1320-114-0x0000000000000000-mapping.dmp

Download
memory/1320-115-0x0000000074440000-0x0000000074470000-memory.dmp

Filesize
192KB

Download
memory/1320-117-0x0000000000D10000-0x0000000000E5A000-memory.dmp

Filesize
1.3MB

Download