dridex | 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11

Analysis

Target
92cd02f630a8576c9ee0e96bc8286c18.dll
Size 616KB
Sample211204-b1tx2scfa4
SHA256 87d2c1489a831b10ed176efb8a1bb73657418e4f332d6de0e10fa0f21c71fa11
MD5 92cd02f630a8576c9ee0e96bc8286c18
SHA1 308dea444f274e72b83bf538a79fde8d73753a81
SHA512 5ea262750be2a5bbbc03a19a5ffcb37f109f7d8913de1aeb64756b5b04c20384c46e605b68b4ed7e3497a7481a8e780ed0a6f9af5d6c83220da300809f99bb55
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1460-117-0x0000000073C80000-0x0000000073D1C000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	1460	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1460	1876	rundll32.exe	68
PID 1876 wrote to memory of 1460	1876	rundll32.exe	68
PID 1876 wrote to memory of 1460	1876	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd02f630a8576c9ee0e96bc8286c18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd02f630a8576c9ee0e96bc8286c18.dll,#1
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232

memory/1460-116-0x0000000004E10000-0x0000000004E16000-memory.dmp

Download

memory/1460-117-0x0000000073C80000-0x0000000073D1C000-memory.dmp

Download