dridex | a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a

Analysis

Target
11817679b95e547beb067f8e82f43108.dll
Size 648KB
Sample211117-xrhdjsafem
SHA256 a3abf81a46e3e318450f496e08d8cd0c9952f43deb4c481e19f9cfd36e884f2a
MD5 11817679b95e547beb067f8e82f43108
SHA1 d9fb4101a76039316a5047da32ac29b575ef8167
SHA512 937c5afda4dfa68638c29fbeb0dcbae4faff4092ab2de38c51da14fb978fe1896f6d8f1648e804160678740842b5cd00bd529286645979601e15586163181426
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3068-116-0x0000000074080000-0x0000000074124000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	3068	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3068	1492	rundll32.exe	68
PID 1492 wrote to memory of 3068	1492	rundll32.exe	68
PID 1492 wrote to memory of 3068	1492	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11817679b95e547beb067f8e82f43108.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11817679b95e547beb067f8e82f43108.dll,#1
  2⤵
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432

memory/3068-116-0x0000000074080000-0x0000000074124000-memory.dmp

Download

memory/3068-118-0x00000000028C0000-0x00000000028C6000-memory.dmp

Download