dridex | 32f8a7972ce0593b753c37f18cce172e3ca2fdca15a0ea6ae6f392fd388a2e20

Analysis

Target
04459ef99e8cca019d3676bd52707e3a.dll
Size 524KB
Sample211213-19mmrsfecj
SHA256 32f8a7972ce0593b753c37f18cce172e3ca2fdca15a0ea6ae6f392fd388a2e20
MD5 04459ef99e8cca019d3676bd52707e3a
SHA1 0cac20c446ba5a0f79290c8b88b762774f046084
SHA512 8d9e7010333d162b31a2244742ca65f8d2cfc46df7902911a8f265247b5f2c1ac80f71150f40caaae4dc4b17ab6a32bf050b73aca7e0e592512840a807b63ebb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3180-115-0x0000000073880000-0x0000000073905000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	3180	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3180	3064	rundll32.exe	69
PID 3064 wrote to memory of 3180	3064	rundll32.exe	69
PID 3064 wrote to memory of 3180	3064	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04459ef99e8cca019d3676bd52707e3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04459ef99e8cca019d3676bd52707e3a.dll,#1
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 704
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216

memory/3180-115-0x0000000073880000-0x0000000073905000-memory.dmp

Download

memory/3180-117-0x0000000000F60000-0x0000000000F83000-memory.dmp

Download