dridex | 834a8705f44eec48b042c99b0ae27caffa3bec191e6269fbf0bfd6675a44f20e

Analysis

Target
Dridex dll (15).dll
Size 648KB
Sample211117-skk4msdbb6
SHA256 834a8705f44eec48b042c99b0ae27caffa3bec191e6269fbf0bfd6675a44f20e
MD5 bd4f864d335995e55501eb9b437101c4
SHA1 31c7324c65023695ed3b4dfd84687f179e12e778
SHA512 6affb1b8b12c15f155617cfc1ff0e0815671d8627fd975b569401cfba7d0405bc37cd5be63ac942b8f621ace54051ee0827ed85c60d6bc11a346b62ee635890a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3764-119-0x0000000073950000-0x00000000739F4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	3764	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3764	3724	rundll32.exe	69
PID 3724 wrote to memory of 3764	3724	rundll32.exe	69
PID 3724 wrote to memory of 3764	3724	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (15).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Dridex dll (15).dll",#1
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:868

memory/3764-119-0x0000000073950000-0x00000000739F4000-memory.dmp

Download

memory/3764-121-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download