dridex | aeb5ba1012635aac25405662d49fb4cee984b6022aa97cf3acc21e505b37fb2a

Analysis

Target
SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll
Size 768KB
Sample211124-vbn52sdbgn
SHA256 aeb5ba1012635aac25405662d49fb4cee984b6022aa97cf3acc21e505b37fb2a
MD5 2c9a177b6a0e43042a46454f467d3aed
SHA1 d57674a7abe5914d4621d75d8f415116326c82d0
SHA512 a2ec03e5cf17e4b4887ee555814a29c2637de3c04d0abd8e9eb8e96aed4383cf1fe00843162e2ea5b1c6eb8875e8cfaac60d1036c7b782715f1a904c33af5c8f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3388-116-0x0000000073E30000-0x0000000073EF2000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	3388	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3388	3380	rundll32.exe	69
PID 3380 wrote to memory of 3388	3380	rundll32.exe	69
PID 3380 wrote to memory of 3388	3380	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497.dll,#1
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1864

memory/3388-116-0x0000000073E30000-0x0000000073EF2000-memory.dmp

Download

memory/3388-118-0x0000000002C50000-0x0000000002C56000-memory.dmp

Download