dridex | 7dd71dac4d68a8d49db4b0077f38225b597591ee52f96fd832acfa552d166979

Analysis

Target
761bc462ddbcce63eade6b6e86929cff.dll
Size 476KB
Sample211206-rmt9naebhr
SHA256 7dd71dac4d68a8d49db4b0077f38225b597591ee52f96fd832acfa552d166979
MD5 761bc462ddbcce63eade6b6e86929cff
SHA1 c6335efafcaf572c3d3695369b580efcb2bceec9
SHA512 93d5c28a47b9165f54a3707f0510c0bf719662ad065bc3088937733ff702e6a8eece927e3fc6d8a9370e254381a06090fbb8d34bbee7c7ef6a4d80ce086d6016
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2744-116-0x0000000073830000-0x00000000738A9000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3560	2744	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2744	2748	rundll32.exe	68
PID 2748 wrote to memory of 2744	2748	rundll32.exe	68
PID 2748 wrote to memory of 2744	2748	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761bc462ddbcce63eade6b6e86929cff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761bc462ddbcce63eade6b6e86929cff.dll,#1
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560

memory/2744-116-0x0000000073830000-0x00000000738A9000-memory.dmp

Download

memory/2744-118-0x0000000001070000-0x0000000001093000-memory.dmp

Download