dridex | b51a917e6c537363330a49f460eb07f15c44d7602b7a8e17258c2fe7ecc71c6e

Analysis

Target

fwhxwujn.bin.dll
Size

368KB
MD5

f16549beb46741a7ab052173af4c620d
SHA1

b117adde9c307494d83f6e76dacefedee1f73380
SHA256

ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75
SHA512

38b5a9852d0895ee8d4df64b3b1824e3accf0458b2eb28a8f162437de30b903fca5ec66627e35b5ade116833b96b99761bb4a8e216e53417a0bcf5a3d809e973

Score

10^/10

dridex 10444 botnet

Family

dridex

Botnet

10444

210.65.244.176:443

37.34.58.210:6601

77.220.64.141:5037

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe
PID 368 wrote to memory of 1952	368	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fwhxwujn.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\fwhxwujn.bin.dll
2⤵
PID:1952

memory/368-59-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Filesize
8KB

Download
memory/1952-60-0x0000000000000000-mapping.dmp

Download
memory/1952-61-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download
memory/1952-62-0x0000000074460000-0x000000007449D000-memory.dmp

Filesize
244KB

Download
memory/1952-63-0x0000000074460000-0x00000000749C1000-memory.dmp

Filesize
5.4MB

Download
memory/1952-64-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download