dridex | fc3f0a97098ad596b964f2092f5bb60c075a9afc6d1b940ec968005314d94de4

Analysis

Target
6b2035816894454336165a076472f75b.dll
Size 476KB
Sample211206-rjed2aebhl
SHA256 fc3f0a97098ad596b964f2092f5bb60c075a9afc6d1b940ec968005314d94de4
MD5 6b2035816894454336165a076472f75b
SHA1 e7ce60a887bd7f7f9a30cf5c1aad0a5532055472
SHA512 7a62aacfb78b9f16e57a96abe7effb563619ea98d364be087f3509f694c8e3ad12e954657be35a05a3296d55c09b8a35ca72948f64df0e639e3af498eefac702
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/8-116-0x0000000073C60000-0x0000000073CD9000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	8	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 8	4092	rundll32.exe	69
PID 4092 wrote to memory of 8	4092	rundll32.exe	69
PID 4092 wrote to memory of 8	4092	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2035816894454336165a076472f75b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b2035816894454336165a076472f75b.dll,#1
  2⤵
  PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:596

memory/8-116-0x0000000073C60000-0x0000000073CD9000-memory.dmp

Download

memory/8-118-0x00000000009D0000-0x00000000009F3000-memory.dmp

Download