dridex | 8f2e0592571ad0147ac0a4fb9c8e8a5fff9ca8ef450b4522ae66aca6243f5138

Analysis

Target
5a66fe2fcfd1de0b4d27f65c23f9b59e.dll
Size 188KB
Sample210922-wytjqagadn
SHA256 8f2e0592571ad0147ac0a4fb9c8e8a5fff9ca8ef450b4522ae66aca6243f5138
MD5 5a66fe2fcfd1de0b4d27f65c23f9b59e
SHA1 159ac0ac6406a39564840edb3550e554f0cdb9b8
SHA512 3c4774594c9fdb721a40dd2af69e176e7d5a974919c70088941ab762aa8309b10ccba3d33204d05c87498cdc5382540fa24a8e3718a53f004e20331b2b7d462e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2356-116-0x00000000743E0000-0x0000000074411000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3700	2356	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2356	2160	rundll32.exe	70
PID 2160 wrote to memory of 2356	2160	rundll32.exe	70
PID 2160 wrote to memory of 2356	2160	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a66fe2fcfd1de0b4d27f65c23f9b59e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a66fe2fcfd1de0b4d27f65c23f9b59e.dll,#1
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3700

memory/2356-116-0x00000000743E0000-0x0000000074411000-memory.dmp

Download

memory/2356-118-0x0000000000CE0000-0x0000000000E2A000-memory.dmp

Download