dridex | ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132

Analysis

Target

ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132.dll
Size

176KB
MD5

fa5ec3e53520d0d4de5e26611b8cd51d
SHA1

6ce8c358ec95955f2816ab1bb376c025ade61922
SHA256

ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132
SHA512

f3d538eb8e584079fe7dc57472a5859b2c935eacb449e94ece4bb6390d97bc4035015de3c5cb0836c58db581e40b821cdc98f16e5f9e6c344ce331372c914360

Score

10^/10

Family

dridex

Botnet

22202

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1776-115-0x0000000074420000-0x0000000074451000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 1776 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2180	1776	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2180 WerFault.exe
Token: SeBackupPrivilege 2180 WerFault.exe
Token: SeDebugPrivilege 2180 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 1776	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1776	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1776	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132.dll,#1
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 644
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180

memory/1776-114-0x0000000000000000-mapping.dmp

Download
memory/1776-115-0x0000000074420000-0x0000000074451000-memory.dmp

Filesize
196KB

Download
memory/1776-117-0x0000000001200000-0x00000000012AE000-memory.dmp

Filesize
696KB

Download