dridex | 5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0

Analysis

Target
Dridex dll.dll
Size 648KB
Sample211117-sjfgrsdba6
SHA256 5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0
MD5 c157d0a0deec07e42d6365a82b73af97
SHA1 421fe163f3428a9d164172cc88543ca0e8f8d502
SHA512 e002017e81d3e5966021a7d9a41aeb9cd0ad3a7e6c9ae92cbc5ab20b8a9d81a2cb9c6b1b906aebc86fa80e9b8d410a14e55b372aa0cf123035166ed43b6209ce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/772-57-0x0000000074AB0000-0x0000000074B54000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	772	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 268 wrote to memory of 772	268	rundll32.exe	28
PID 772 wrote to memory of 1368	772	rundll32.exe	29
PID 772 wrote to memory of 1368	772	rundll32.exe	29
PID 772 wrote to memory of 1368	772	rundll32.exe	29
PID 772 wrote to memory of 1368	772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 268
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1368

memory/772-56-0x0000000076241000-0x0000000076243000-memory.dmp

Download

memory/772-57-0x0000000074AB0000-0x0000000074B54000-memory.dmp

Download

memory/772-59-0x00000000000C0000-0x00000000000C6000-memory.dmp

Download

memory/1368-61-0x0000000000690000-0x0000000000691000-memory.dmp

Download