dridex | 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe

Analysis

Target
GjEdowscAmeMpshekniggagook.flac.dll
Size 432KB
Sample211122-t384vsbaf9
SHA256 6158375fa9e56105f92dd0b703cae796ad163906b83506b6e2e7c8a6348757fe
MD5 6a43624a01c4463c9bfbc2035a3efcec
SHA1 5ace338282107a131e14fcf226844010518190fd
SHA512 527ed88c98bff0f2fe3edb31fe9024448138e8d3f20093e501e704799c68f078c00b7bba8e2af649a5241588780159dee8037307d152fefb636e076b94a11539
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2728-119-0x00000000738C0000-0x000000007392D000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3576	2728	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2728	2708	rundll32.exe	68
PID 2708 wrote to memory of 2728	2708	rundll32.exe	68
PID 2708 wrote to memory of 2728	2708	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GjEdowscAmeMpshekniggagook.flac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GjEdowscAmeMpshekniggagook.flac.dll,#1
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

memory/2728-119-0x00000000738C0000-0x000000007392D000-memory.dmp

Download

memory/2728-121-0x0000000003200000-0x00000000032AE000-memory.dmp

Download