dridex | 492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be

Analysis

Target
6f12d78d46043dc63d825a1999869c8c.dll
Size 524KB
Sample211215-2askeabecj
SHA256 492fe6caf5e12dcb484f636079c246fbf0ab4b8ed59e8e5a61131dbd1fd4d2be
MD5 6f12d78d46043dc63d825a1999869c8c
SHA1 25620bec00b268be3c1bdf91386eeb8ca61b897f
SHA512 53b5c7da24aa83003b6a7ecf7a6ae90892a4675f1cdab4367ae44ceaf3dc42b55ed1e58a10d5332372691d9422fa58acb7b99bacaca06cc5fe756a0d013bc589
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3740-116-0x00000000741D0000-0x0000000074255000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3692	3740	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3740	3816	rundll32.exe	69
PID 3816 wrote to memory of 3740	3816	rundll32.exe	69
PID 3816 wrote to memory of 3740	3816	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f12d78d46043dc63d825a1999869c8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f12d78d46043dc63d825a1999869c8c.dll,#1
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 708
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3692

memory/3740-116-0x00000000741D0000-0x0000000074255000-memory.dmp

Download

memory/3740-118-0x0000000004B70000-0x0000000004B76000-memory.dmp

Download