dridex | 6e2c1bfe691c3b9ae8d63f04fb1c129c7935c8a02ea04a45511f582d4155a2ba

Analysis

Target
dc3680122e796c02e0700af8efbd8d94.dll
Size 476KB
Sample211206-rjed2ahbb3
SHA256 6e2c1bfe691c3b9ae8d63f04fb1c129c7935c8a02ea04a45511f582d4155a2ba
MD5 dc3680122e796c02e0700af8efbd8d94
SHA1 adc1e7c1ad682693eab2fe4d2b2ff1d3b186b418
SHA512 6003c710927f54d3168695c3f8d72b0fd8521eb543117374cde1852ef74db43223a69ef2abd254f9ed27eb52db2e5d548ff1a5f11e01001694a33de9b6fb81a1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2412-119-0x00000000735F0000-0x0000000073669000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	2412	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2412	2380	rundll32.exe	68
PID 2380 wrote to memory of 2412	2380	rundll32.exe	68
PID 2380 wrote to memory of 2412	2380	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc3680122e796c02e0700af8efbd8d94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc3680122e796c02e0700af8efbd8d94.dll,#1
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:868

memory/2412-119-0x00000000735F0000-0x0000000073669000-memory.dmp

Download

memory/2412-121-0x00000000003D0000-0x00000000003D6000-memory.dmp

Download