dridex | 33dbd70f8f7cc2a6f040b6f6ea3e973856cfd5b1077741cb3b2ee14754aa015a

Analysis

Target
b8875df89fabedcab476fa41a2d0ce3b.dll
Size 476KB
Sample211206-rmvkeshbc6
SHA256 33dbd70f8f7cc2a6f040b6f6ea3e973856cfd5b1077741cb3b2ee14754aa015a
MD5 b8875df89fabedcab476fa41a2d0ce3b
SHA1 114381765ca7fe6a3e0ed20c6357edeaf4fe1e92
SHA512 f7febc2ada5c80e3a2999527a08dbffe97d1a6d0084e424bd895c58078046c1840997838d82a09ef1dd219b853c738184a69d8882cf9c8fb78369c9f39024909
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1764-57-0x00000000748C0000-0x0000000074939000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	1764	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1684 wrote to memory of 1764	1684	rundll32.exe	27
PID 1764 wrote to memory of 568	1764	rundll32.exe	29
PID 1764 wrote to memory of 568	1764	rundll32.exe	29
PID 1764 wrote to memory of 568	1764	rundll32.exe	29
PID 1764 wrote to memory of 568	1764	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8875df89fabedcab476fa41a2d0ce3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8875df89fabedcab476fa41a2d0ce3b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 344
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:568

memory/568-62-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1764-56-0x0000000075B71000-0x0000000075B73000-memory.dmp

Download

memory/1764-57-0x00000000748C0000-0x0000000074939000-memory.dmp

Download

memory/1764-61-0x0000000000100000-0x0000000000106000-memory.dmp

Download