dridex | 1d29ecde092f21ea0dd05b9f42531be1ed2207d6ebb9b463517f4c9508ff24a7

Analysis

Target
7b0928f7168c96f91db6c452ce5367f0.dll
Size 616KB
Sample211203-wprnrscba5
SHA256 1d29ecde092f21ea0dd05b9f42531be1ed2207d6ebb9b463517f4c9508ff24a7
MD5 7b0928f7168c96f91db6c452ce5367f0
SHA1 fe6b0e6a6241ea9e2bb625a1290ac2b4e8f0d2f8
SHA512 8a87cb11233c226934013401222abb94639232a90d080b1d2593579e64936a156a87de03646c08b47158cea1a71f11ed33a6ddb19643fc5e8e413074eb11f788
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3772-116-0x0000000073B00000-0x0000000073B9C000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3144	3772	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3772	3140	rundll32.exe	69
PID 3140 wrote to memory of 3772	3140	rundll32.exe	69
PID 3140 wrote to memory of 3772	3140	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b0928f7168c96f91db6c452ce5367f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b0928f7168c96f91db6c452ce5367f0.dll,#1
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144

memory/3772-116-0x0000000073B00000-0x0000000073B9C000-memory.dmp

Download

memory/3772-118-0x00000000029A0000-0x00000000029A6000-memory.dmp

Download