dridex | 33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f

Analysis

Target
230a877245603089b5c5bc120ef59320.dll
Size 648KB
Sample211117-xrhdjsafel
SHA256 33df285d24bac325fa5c56a08462a3ebf34904e4489abe7e6854f3f993ac033f
MD5 230a877245603089b5c5bc120ef59320
SHA1 63a8cad3446d7789167f152c3264870090945935
SHA512 d9100798e89d1e7cd5f12ba7d037314b8d3448e6b16ca52ff3d3569fc1e742377e606ced31f625d868e6268b35dfb4b01d31a656631626aec95c4c12a7dfe821
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2184-116-0x0000000073750000-0x00000000737F4000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2184	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2184	1548	rundll32.exe	68
PID 1548 wrote to memory of 2184	1548	rundll32.exe	68
PID 1548 wrote to memory of 2184	1548	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\230a877245603089b5c5bc120ef59320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\230a877245603089b5c5bc120ef59320.dll,#1
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2164

memory/2184-116-0x0000000073750000-0x00000000737F4000-memory.dmp

Download

memory/2184-118-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download