dridex | 9417c39209cd840dfd4884436ba31e6469f75afc8a1bd97764e6e98711e6e417

Analysis

Target
64f1d3f20915386aaaae6aae2c27c045.dll
Size 652KB
Sample211117-y55axaahcl
SHA256 9417c39209cd840dfd4884436ba31e6469f75afc8a1bd97764e6e98711e6e417
MD5 64f1d3f20915386aaaae6aae2c27c045
SHA1 752026e18f5ed59b924371898b4a0c1ea458e2df
SHA512 6c5978fe9fe7c0744d927d330094ae02d97176f0dc792637567632fd4936b027fd40e211d0fbab748e994b9686db1924e0382923499ebc29683b703e2461670a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 660 created 3784	660	WerFault.exe	68

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3784-120-0x0000000073880000-0x0000000073924000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
660	3784	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3784	1676	rundll32.exe	68
PID 1676 wrote to memory of 3784	1676	rundll32.exe	68
PID 1676 wrote to memory of 3784	1676	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64f1d3f20915386aaaae6aae2c27c045.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64f1d3f20915386aaaae6aae2c27c045.dll,#1
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 656
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:660

memory/3784-119-0x0000000001050000-0x0000000001056000-memory.dmp

Download

memory/3784-120-0x0000000073880000-0x0000000073924000-memory.dmp

Download