dridex | aeb5ba1012635aac25405662d49fb4cee984b6022aa97cf3acc21e505b37fb2a

Analysis

Target
SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll
Size 768KB
Sample211124-vbn52sdbgn
SHA256 aeb5ba1012635aac25405662d49fb4cee984b6022aa97cf3acc21e505b37fb2a
MD5 2c9a177b6a0e43042a46454f467d3aed
SHA1 d57674a7abe5914d4621d75d8f415116326c82d0
SHA512 a2ec03e5cf17e4b4887ee555814a29c2637de3c04d0abd8e9eb8e96aed4383cf1fe00843162e2ea5b1c6eb8875e8cfaac60d1036c7b782715f1a904c33af5c8f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/576-57-0x0000000074630000-0x00000000746F2000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	576	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 1600 wrote to memory of 576	1600	rundll32.exe	28
PID 576 wrote to memory of 756	576	rundll32.exe	29
PID 576 wrote to memory of 756	576	rundll32.exe	29
PID 576 wrote to memory of 756	576	rundll32.exe	29
PID 576 wrote to memory of 756	576	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 264
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:756

memory/576-56-0x0000000075491000-0x0000000075493000-memory.dmp

Download

memory/576-57-0x0000000074630000-0x00000000746F2000-memory.dmp

Download

memory/576-60-0x0000000000200000-0x0000000000206000-memory.dmp

Download

memory/756-61-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download