dridex | 1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf

Analysis

Target
dd8816152e74478c48e5780a992d6acb.dll
Size 616KB
Sample211204-gal3eadce3
SHA256 1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf
MD5 dd8816152e74478c48e5780a992d6acb
SHA1 97f00f22381d23db3f7bc85b907e3b367cb2d83a
SHA512 0b260c89ec263c3bf8837ac4e63e5635212bca1108cb63aea05f711d79d39e842d20ef1f0cd8e8158c06cf8399cee6b8905d7c295b9d6e73490a14ac9a62fa3b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1100-57-0x0000000074EB0000-0x0000000074F4C000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	1100	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1204 wrote to memory of 1100	1204	rundll32.exe	27
PID 1100 wrote to memory of 568	1100	rundll32.exe	29
PID 1100 wrote to memory of 568	1100	rundll32.exe	29
PID 1100 wrote to memory of 568	1100	rundll32.exe	29
PID 1100 wrote to memory of 568	1100	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8816152e74478c48e5780a992d6acb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8816152e74478c48e5780a992d6acb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 236
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:568

memory/568-62-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1100-56-0x00000000768A1000-0x00000000768A3000-memory.dmp

Download

memory/1100-57-0x0000000074EB0000-0x0000000074F4C000-memory.dmp

Download

memory/1100-61-0x0000000000200000-0x0000000000206000-memory.dmp

Download