dridex | 33dbd70f8f7cc2a6f040b6f6ea3e973856cfd5b1077741cb3b2ee14754aa015a

Analysis

Target
b8875df89fabedcab476fa41a2d0ce3b.dll
Size 476KB
Sample211206-rmvkeshbc6
SHA256 33dbd70f8f7cc2a6f040b6f6ea3e973856cfd5b1077741cb3b2ee14754aa015a
MD5 b8875df89fabedcab476fa41a2d0ce3b
SHA1 114381765ca7fe6a3e0ed20c6357edeaf4fe1e92
SHA512 f7febc2ada5c80e3a2999527a08dbffe97d1a6d0084e424bd895c58078046c1840997838d82a09ef1dd219b853c738184a69d8882cf9c8fb78369c9f39024909
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3588-119-0x0000000074280000-0x00000000742F9000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	3588	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8875df89fabedcab476fa41a2d0ce3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8875df89fabedcab476fa41a2d0ce3b.dll,#1
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836

memory/3588-119-0x0000000074280000-0x00000000742F9000-memory.dmp

Download

memory/3588-121-0x0000000000D90000-0x0000000000EDA000-memory.dmp

Download