dridex | f034db216df8d2e4b49cdfeae61e367c021d40458433f2af1068db8a9823d7d9

Analysis

Target
4dfbcd7756a89d220cc8134c3c7f8352.dll
Size 175KB
Sample210728-4ct3a3d17s
SHA256 f034db216df8d2e4b49cdfeae61e367c021d40458433f2af1068db8a9823d7d9
MD5 4dfbcd7756a89d220cc8134c3c7f8352
SHA1 ee8203a68f9e42d1eadc96d81d7e2b9f708724f6
SHA512 59072f0e333735e9d7304399cc0cf6f10ad69b81d1a090ee56fb5656c3b3068061b59adbb4b1e9cb351cb16e1725ebead18c10e3e461abccd527de7dfa46e260
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 192 created 3552	192	WerFault.exe	70

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3552-115-0x0000000073990000-0x00000000739C0000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
192	3552	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3552	3260	rundll32.exe	70
PID 3260 wrote to memory of 3552	3260	rundll32.exe	70
PID 3260 wrote to memory of 3552	3260	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfbcd7756a89d220cc8134c3c7f8352.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfbcd7756a89d220cc8134c3c7f8352.dll,#1
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 592
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:192

memory/3552-115-0x0000000073990000-0x00000000739C0000-memory.dmp

Download

memory/3552-117-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download