dridex | 1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf

Analysis

Target
dd8816152e74478c48e5780a992d6acb.dll
Size 616KB
Sample211204-gal3eadce3
SHA256 1ca9365813fc56e27b3a2fad0a6abc8268252593a89b3d8d9d699e6042f33fdf
MD5 dd8816152e74478c48e5780a992d6acb
SHA1 97f00f22381d23db3f7bc85b907e3b367cb2d83a
SHA512 0b260c89ec263c3bf8837ac4e63e5635212bca1108cb63aea05f711d79d39e842d20ef1f0cd8e8158c06cf8399cee6b8905d7c295b9d6e73490a14ac9a62fa3b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2744-119-0x0000000073890000-0x000000007392C000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	2744	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2744	2716	rundll32.exe	68
PID 2716 wrote to memory of 2744	2716	rundll32.exe	68
PID 2716 wrote to memory of 2744	2716	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8816152e74478c48e5780a992d6acb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8816152e74478c48e5780a992d6acb.dll,#1
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 636
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4072

memory/2744-119-0x0000000073890000-0x000000007392C000-memory.dmp

Download

memory/2744-121-0x0000000000490000-0x0000000000496000-memory.dmp

Download