dridex | b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495

Analysis

Target
f7703084b13482c646f3851e18d8951a.dll
Size 476KB
Sample211206-sdbxdsechk
SHA256 b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495
MD5 f7703084b13482c646f3851e18d8951a
SHA1 939ff0c3db869fa5656b6905f824fdb69050e43c
SHA512 1c9e8a129bf0a634582343f14283d5bf152adc58f51230bf288482f49c5605c62b320ae1577571faf039a2b6c070985c251fa0f4a804e1dc98e287f087273498
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3588-119-0x0000000074280000-0x00000000742F9000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	3588	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7703084b13482c646f3851e18d8951a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7703084b13482c646f3851e18d8951a.dll,#1
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836

memory/3588-119-0x0000000074280000-0x00000000742F9000-memory.dmp

Download

memory/3588-121-0x0000000000700000-0x0000000000706000-memory.dmp

Download