dridex | 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11

Analysis

Target
92cd02f630a8576c9ee0e96bc8286c18.dll
Size 616KB
Sample211204-b1tx2scfa4
SHA256 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
MD5 92cd02f630a8576c9ee0e96bc8286c18
SHA1 308dea444f274e72b83bf538a79fde8d73753a81
SHA512 5ea262750be2a5bbbc03a19a5ffcb37f109f7d8913de1aeb64756b5b04c20384c46e605b68b4ed7e3497a7481a8e780ed0a6f9af5d6c83220da300809f99bb55
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/332-57-0x00000000752E0000-0x000000007537C000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
572	332	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
572	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 796 wrote to memory of 332	796	rundll32.exe	28
PID 332 wrote to memory of 572	332	rundll32.exe	29
PID 332 wrote to memory of 572	332	rundll32.exe	29
PID 332 wrote to memory of 572	332	rundll32.exe	29
PID 332 wrote to memory of 572	332	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd02f630a8576c9ee0e96bc8286c18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd02f630a8576c9ee0e96bc8286c18.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 236
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:572

memory/332-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/332-57-0x00000000752E0000-0x000000007537C000-memory.dmp

Download

memory/332-61-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/572-62-0x0000000000420000-0x0000000000421000-memory.dmp

Download