dridex | ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba

Analysis

Target
tWJVslCUpcEaUuDcuntfuck.mp4.dll
Size 428KB
Sample211122-tp87psgaaq
SHA256 ee1259ba7e41be5e8f11fb7ed2fb983bd9a48e757cf59690336aa63ac2497dba
MD5 0247b0cb108b16d63646a1cf558141c1
SHA1 32fd4277daaa3ac2095908562acff7459e3cd872
SHA512 d967360e1896e62e374b5675d6eef20094e71903149df424e8c7563da7a3f2ee059447c6c0ebd8d46514cfef6000e72f65e4dff4f99671cf8956bbd100315288
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3028-116-0x00000000738E0000-0x000000007394D000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	3028	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3028	2776	rundll32.exe	68
PID 2776 wrote to memory of 3028	2776	rundll32.exe	68
PID 2776 wrote to memory of 3028	2776	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tWJVslCUpcEaUuDcuntfuck.mp4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tWJVslCUpcEaUuDcuntfuck.mp4.dll,#1
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3636

memory/3028-116-0x00000000738E0000-0x000000007394D000-memory.dmp

Download

memory/3028-118-0x00000000045E0000-0x00000000045E6000-memory.dmp

Download