dridex | 5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0

Analysis

Target
Dridex dll.dll
Size 648KB
Sample211117-sjfgrsdba6
SHA256 5d2ab3a55ea082117d480a9ec3461a96f831b2107ffdf57c1385f8ab2c4f31d0
MD5 c157d0a0deec07e42d6365a82b73af97
SHA1 421fe163f3428a9d164172cc88543ca0e8f8d502
SHA512 e002017e81d3e5966021a7d9a41aeb9cd0ad3a7e6c9ae92cbc5ab20b8a9d81a2cb9c6b1b906aebc86fa80e9b8d410a14e55b372aa0cf123035166ed43b6209ce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3668-119-0x00000000739F0000-0x0000000073A94000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	3668	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3668	3612	rundll32.exe	69
PID 3612 wrote to memory of 3668	3612	rundll32.exe	69
PID 3612 wrote to memory of 3668	3612	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll.dll",#1
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748

memory/3668-119-0x00000000739F0000-0x0000000073A94000-memory.dmp

Download

memory/3668-121-0x0000000004070000-0x0000000004076000-memory.dmp

Download