dridex | bb26c9f976e5cd4a63cc57453d42eeffa93c9522074eaa20042ea1eb9c7a1100

Analysis

Target
53b7dfea4f16dc18640e9819559373f0.dll
Size 476KB
Sample211206-zpx3bsfbbm
SHA256 bb26c9f976e5cd4a63cc57453d42eeffa93c9522074eaa20042ea1eb9c7a1100
MD5 53b7dfea4f16dc18640e9819559373f0
SHA1 1f844d912d1662e9eecf84e76bec1c0c46c06ec9
SHA512 2f68ec5444c00dbae1085d79ed49f4de7ce15b0fe147bcf894a8971cfc872fe8d009000ad4b1a6df6b2c76fab4fd1e3a636a5dc1711fa47dfd6cd348e6fd8eef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3308-116-0x0000000073F20000-0x0000000073F99000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	3308	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3308	2176	rundll32.exe	68
PID 2176 wrote to memory of 3308	2176	rundll32.exe	68
PID 2176 wrote to memory of 3308	2176	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b7dfea4f16dc18640e9819559373f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b7dfea4f16dc18640e9819559373f0.dll,#1
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3368

memory/3308-116-0x0000000073F20000-0x0000000073F99000-memory.dmp

Download

memory/3308-118-0x00000000006F0000-0x0000000000713000-memory.dmp

Download