dridex | cd2aedfa1d7113c4aa22764886c0918455e77408db27b0350c91ffdf61bb213d

Analysis

Target
SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll
Size 652KB
Sample211117-1yb2wsbbam
SHA256 cd2aedfa1d7113c4aa22764886c0918455e77408db27b0350c91ffdf61bb213d
MD5 4ac20af1cc1553937c1e1ca000e56be1
SHA1 b390aa3d6a8191d69787fbe170b106d26ff90dc5
SHA512 3fd811ff780f217798529abbc0c73efd1ceca5742c58417eb437b8c66e3803bc4eb9bab314f5948c73f697cff5fcf8f3d530a707121ca9ab23b15316adb3b5d6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2452 created 2764	2452	WerFault.exe	69

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2764-116-0x0000000073910000-0x00000000739B4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2764	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2764	2704	rundll32.exe	69
PID 2704 wrote to memory of 2764	2704	rundll32.exe	69
PID 2704 wrote to memory of 2764	2704	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.777.3977.9588.dll,#1
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 660
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2452

memory/2764-116-0x0000000073910000-0x00000000739B4000-memory.dmp

Download

memory/2764-118-0x0000000002FF0000-0x0000000002FF6000-memory.dmp

Download