dridex | f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c

Analysis

Target
e3f9210a7ba3403b0e386f0c5c25e623.dll
Size 648KB
Sample211118-swclmsedaq
SHA256 f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c
MD5 e3f9210a7ba3403b0e386f0c5c25e623
SHA1 8f89b9c2be39f8a3cc95fbafdfbd3f8e777625bd
SHA512 eab346548ee20c7824f70f7d478ebf1a2ee8374b22254ad4e79d42fe483fbd7fa99f2b28230435ccd2e6a1866488fe8d35d5ec7cfd990f9641fedfc7fbe31fae
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3304-116-0x0000000073EF0000-0x0000000073F94000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	3304	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 3304	696	rundll32.exe	68
PID 696 wrote to memory of 3304	696	rundll32.exe	68
PID 696 wrote to memory of 3304	696	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3f9210a7ba3403b0e386f0c5c25e623.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3f9210a7ba3403b0e386f0c5c25e623.dll,#1
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3332

memory/3304-116-0x0000000073EF0000-0x0000000073F94000-memory.dmp

Download

memory/3304-118-0x00000000009A0000-0x0000000000AEA000-memory.dmp

Download