dridex | 10e5f3b96a81bb3b849a9dbba33d6f297d38b417e7d6269fbcff0ce876dcb47e

Analysis

Target
Dridex dll (14).dll
Size 648KB
Sample211117-skk4msaahk
SHA256 10e5f3b96a81bb3b849a9dbba33d6f297d38b417e7d6269fbcff0ce876dcb47e
MD5 9b24b1b889ce6c41235c1364fe2287c6
SHA1 0639b4df51a5588d07b090821a41afc3d8f159fa
SHA512 fce8633511ba491ce164890a6d182e50226dc76f2c2d3df4a2c399f7d4767503dff7f3ad30628caf83943b4fbb61bdafe51e7581e990d4e27e6ce64ed096791f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/480-116-0x0000000074130000-0x00000000741D4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	480	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 480	364	rundll32.exe	68
PID 364 wrote to memory of 480	364	rundll32.exe	68
PID 364 wrote to memory of 480	364	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (14).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (14).dll",#1
  2⤵
  PID:480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3948

memory/480-116-0x0000000074130000-0x00000000741D4000-memory.dmp

Download

memory/480-118-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Download