dridex | b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d

Analysis

Target
Dridex dll (12).dll
Size 648KB
Sample211117-sj21rsdbb2
SHA256 b2b43eefd7ae4cedb7d504f44ccdba410d0465017a92becfbc9730e57893671d
MD5 ac29dcd7fd74816cd403eafbffef42ef
SHA1 8d57dcc480124967f2e286bcff84d030148da680
SHA512 a8d902cdee7adfbd2f03c1fbeeb078dc39beecee14809d7a53b2d67442ef8ade13b993a2811df625477ffdf3344098f7140aa27eee39dd4a9cad6b2f837789fb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3720-119-0x0000000073C10000-0x0000000073CB4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	3720	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 68 wrote to memory of 3720	68	rundll32.exe	69
PID 68 wrote to memory of 3720	68	rundll32.exe	69
PID 68 wrote to memory of 3720	68	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (12).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:68
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (12).dll",#1
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:728

memory/3720-119-0x0000000073C10000-0x0000000073CB4000-memory.dmp

Download

memory/3720-121-0x0000000003400000-0x000000000354A000-memory.dmp

Download