dridex | a88a99b1942bc792d14711ebd755deb0a47cc3e295ac75937478db03b784b5df

Analysis

Target
SecuriteInfo.com.Variant.Lazy.88453.2238.30968.dll
Size 512KB
Sample211220-t64csabbh8
SHA256 a88a99b1942bc792d14711ebd755deb0a47cc3e295ac75937478db03b784b5df
MD5 405e499e0b8bb4f4e4742958643200b6
SHA1 d7da9fc03e550205b4c922c372bb23ffeef060a8
SHA512 819bcfa0abac74ef9f622fcbdb13e1222b95e3a19b3ddbb2bf63fe6cd415cb1dadbab7b069a5438f45552346c7bf153d648b688854d99eb36ff99380b176c674
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1904-116-0x0000000073480000-0x0000000073501000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	1904	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1904	832	rundll32.exe	69
PID 832 wrote to memory of 1904	832	rundll32.exe	69
PID 832 wrote to memory of 1904	832	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.88453.2238.30968.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.88453.2238.30968.dll,#1
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

memory/1904-116-0x0000000073480000-0x0000000073501000-memory.dmp

Download

memory/1904-118-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download