dridex | a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a

Analysis

Target
11817679b95e547beb067f8e82f43108.dll
Size 648KB
Sample211117-xrhdjsafem
SHA256 a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
MD5 11817679b95e547beb067f8e82f43108
SHA1 d9fb4101a76039316a5047da32ac29b575ef8167
SHA512 937c5afda4dfa68638c29fbeb0dcbae4faff4092ab2de38c51da14fb978fe1896f6d8f1648e804160678740842b5cd00bd529286645979601e15586163181426
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/764-57-0x00000000751D0000-0x0000000075274000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	764	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
616	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 1512 wrote to memory of 764	1512	rundll32.exe	28
PID 764 wrote to memory of 616	764	rundll32.exe	29
PID 764 wrote to memory of 616	764	rundll32.exe	29
PID 764 wrote to memory of 616	764	rundll32.exe	29
PID 764 wrote to memory of 616	764	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11817679b95e547beb067f8e82f43108.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11817679b95e547beb067f8e82f43108.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 268
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:616

memory/616-62-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/764-56-0x0000000076A21000-0x0000000076A23000-memory.dmp

Download

memory/764-57-0x00000000751D0000-0x0000000075274000-memory.dmp

Download

memory/764-61-0x0000000000170000-0x0000000000176000-memory.dmp

Download