dridex | 7fefd24874a34e614d9089a0a9ebd85458ec71ae328edbd6197a421aec3e2aba

Analysis

Target
triage_dropped_file.dll
Size 188KB
Sample210908-rykvcsefd4
SHA256 7fefd24874a34e614d9089a0a9ebd85458ec71ae328edbd6197a421aec3e2aba
MD5 1ed5cbdcf881120034d81d5a46399341
SHA1 72355327991131e4901bf353957a9c4a16211ccd
SHA512 d610e9e6cc61d74a7f47714b0784edda9ac5e47f6500ed6ec7040994addb32a39b6384fcec71692374ecbdc8807a9291b44a1ce052e2928cf39909419936c911
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2640 created 3848	2640	WerFault.exe	72

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3848-116-0x0000000073C00000-0x0000000073C30000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	3848	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 15 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3848	3176	rundll32.exe	72
PID 3176 wrote to memory of 3848	3176	rundll32.exe	72
PID 3176 wrote to memory of 3848	3176	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
  2⤵
  PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 684
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2640

memory/3848-116-0x0000000073C00000-0x0000000073C30000-memory.dmp

Download

memory/3848-118-0x0000000003110000-0x0000000003116000-memory.dmp

Download