dridex | 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe

Analysis

Target
GjEdowscAmeMpshekniggagook.flac.dll
Size 432KB
Sample211122-t384vsbaf9
SHA256 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe
MD5 6a43624a01c4463c9bfbc2035a3efcec
SHA1 5ace338282107a131e14fcf226844010518190fd
SHA512 527ed88c98bff0f2fe3edb31fe9024448138e8d3f20093e501e704799c68f078c00b7bba8e2af649a5241588780159dee8037307d152fefb636e076b94a11539
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1608-57-0x0000000075360000-0x00000000753CD000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
788	1608	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
788	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1552 wrote to memory of 1608	1552	rundll32.exe	27
PID 1608 wrote to memory of 788	1608	rundll32.exe	29
PID 1608 wrote to memory of 788	1608	rundll32.exe	29
PID 1608 wrote to memory of 788	1608	rundll32.exe	29
PID 1608 wrote to memory of 788	1608	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GjEdowscAmeMpshekniggagook.flac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GjEdowscAmeMpshekniggagook.flac.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 268
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:788

memory/788-61-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/1608-56-0x0000000075B71000-0x0000000075B73000-memory.dmp

Download

memory/1608-57-0x0000000075360000-0x00000000753CD000-memory.dmp

Download

memory/1608-60-0x00000000000C0000-0x00000000000C6000-memory.dmp

Download