dridex | 87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e

Analysis

Target
4e56e551c6c189a52d3e890f84394842.dll
Size 648KB
Sample211118-srbtjshde9
SHA256 87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e
MD5 4e56e551c6c189a52d3e890f84394842
SHA1 a4101d34d5dbf7d7248750937905202ec6723037
SHA512 39304fc9ad1e6a1efbfa3885977422e4bc47c403c4c4a73a34f4f053f1a117d667dea27e16428866272399b47fcc56725953e94b551820c90859e96c02764074
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3388-120-0x00000000743D0000-0x0000000074474000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3792	3388	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3388	1776	rundll32.exe	68
PID 1776 wrote to memory of 3388	1776	rundll32.exe	68
PID 1776 wrote to memory of 3388	1776	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e56e551c6c189a52d3e890f84394842.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e56e551c6c189a52d3e890f84394842.dll,#1
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3792

memory/3388-119-0x00000000006E0000-0x000000000082A000-memory.dmp

Download

memory/3388-120-0x00000000743D0000-0x0000000074474000-memory.dmp

Download