dridex | 24aa64643c101064bade7ca8cd217496cfc1da80fde9376b9d32518810d30f3f

Analysis

Target
8419308ecb6a55542266df2590a5ee1c.dll
Size 652KB
Sample211117-y2pfaaahar
SHA256 24aa64643c101064bade7ca8cd217496cfc1da80fde9376b9d32518810d30f3f
MD5 8419308ecb6a55542266df2590a5ee1c
SHA1 c3974d090ec1fdced31d36bbd46ab68dd3d1c106
SHA512 f14bfc09813f9a15fc0fabe8e8aef95018941afeed2c13ecaa0567cb0a5405b0abf6e82c9a21e20de6c4a4209c9ccb88896bf43e5465178bfb01c4c959c875ca
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 672 created 3464	672	WerFault.exe	69

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3464-116-0x0000000073F60000-0x0000000074004000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	3464	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3464	3144	rundll32.exe	69
PID 3144 wrote to memory of 3464	3144	rundll32.exe	69
PID 3144 wrote to memory of 3464	3144	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419308ecb6a55542266df2590a5ee1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8419308ecb6a55542266df2590a5ee1c.dll,#1
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 656
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:672

memory/3464-116-0x0000000073F60000-0x0000000074004000-memory.dmp

Download

memory/3464-118-0x0000000004660000-0x0000000004666000-memory.dmp

Download