dridex | ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc

Analysis

Target
205bd4c7add67585dafb8bc9e4a64595.dll
Size 648KB
Sample211118-eknymsbfcn
SHA256 ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc
MD5 205bd4c7add67585dafb8bc9e4a64595
SHA1 53c1e8f6f81aefdf17e6a0b27a8e1a1fdbac81c9
SHA512 52d63a93b8e7c6b44e442efde9e442a30ef3a6b4520d3b635521b32327686b10f7b4a0b84b74e66bc149ab432b3ba57eeb13983adfb385397095e9dc3df78786
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2212-116-0x0000000073EE0000-0x0000000073F84000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2212	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2212	3792	rundll32.exe	68
PID 3792 wrote to memory of 2212	3792	rundll32.exe	68
PID 3792 wrote to memory of 2212	3792	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\205bd4c7add67585dafb8bc9e4a64595.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\205bd4c7add67585dafb8bc9e4a64595.dll,#1
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2508

memory/2212-116-0x0000000073EE0000-0x0000000073F84000-memory.dmp

Download

memory/2212-118-0x0000000003370000-0x0000000003376000-memory.dmp

Download