dridex | 3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30

Analysis

Target
b3e06fffaf8168fea8172a799556a1fe.dll
Size 616KB
Sample211203-m5pdxabbg4
SHA256 3f93bbbd31f1ca5627326b08e3fdffeed857a43e0800fb2e0503065adf42be30
MD5 b3e06fffaf8168fea8172a799556a1fe
SHA1 5e000ba01ecfc07471e514235951d5c4c523a53a
SHA512 e8095015d681f38a638f5e1056664e08d14341910b04aefe7f365a23561b5b7bd7319a941dc80384765240944dcdf5a5a8262fc62b35f524c2c83edd43c23e31
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3820-119-0x0000000073B60000-0x0000000073BFC000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	3820	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3e06fffaf8168fea8172a799556a1fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3e06fffaf8168fea8172a799556a1fe.dll,#1
  2⤵
  PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3836

memory/3820-119-0x0000000073B60000-0x0000000073BFC000-memory.dmp

Download

memory/3820-121-0x00000000031F0000-0x00000000031F6000-memory.dmp

Download