dridex | eebfb3d0367d2dad5db7477869bab47f183cbd7a58a48c0592c8e9aa5b38861f

Analysis

Target
2uyv6x53xzch74.php.dll
Size 188KB
Sample210825-4pn1cm342s
SHA256 eebfb3d0367d2dad5db7477869bab47f183cbd7a58a48c0592c8e9aa5b38861f
MD5 0fdb784f5c2dca9e625bbba1c3bdc2c9
SHA1 82339263b8bbfeb1cf30b347a102872f68670bd3
SHA512 95c4f4c8bd536430bcf82a8b4e758b1c7dc427ce0779a7103d6b24457e7edbe0fb624b33781ecfcb1e46edbce36a4cab43d3de81843dbef5dc0f8af6e88c29bf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1528 created 900	1528	WerFault.exe	71

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/900-115-0x0000000073890000-0x00000000738C0000-memory.dmp	dridex_ldr

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2776	900	WerFault.exe	71
1528	900	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 28 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 900	3008	rundll32.exe	71
PID 3008 wrote to memory of 900	3008	rundll32.exe	71
PID 3008 wrote to memory of 900	3008	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2uyv6x53xzch74.php.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2uyv6x53xzch74.php.dll,#1
  2⤵
  PID:900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 712
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 728
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1528

memory/900-115-0x0000000073890000-0x00000000738C0000-memory.dmp

Download

memory/900-117-0x0000000003100000-0x000000000324A000-memory.dmp

Download