dridex | 59b90c2d9f7732201c2f5498de46accdc545fe34a165bcbba4bd1fb304e3033e

Analysis

Target
SecuriteInfo.com.Variant.Lazy.88453.25364.24043.dll
Size 512KB
Sample211220-t64csacabk
SHA256 59b90c2d9f7732201c2f5498de46accdc545fe34a165bcbba4bd1fb304e3033e
MD5 73f957682c5c16154927b0eb12240fa6
SHA1 11cbd62340e288d7771ffd61859972ee752c023f
SHA512 b39504607221ca852d200fd7d6f6b2a17e7a3c4b9cc12f18766fdda79454706df4dadd0cbdc9c3ed2328ba19e6026628a7e1ea49cdf6efd37a31701045077afd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2456-116-0x0000000073760000-0x00000000737E1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2456	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2456	660	rundll32.exe	69
PID 660 wrote to memory of 2456	660	rundll32.exe	69
PID 660 wrote to memory of 2456	660	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.88453.25364.24043.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.88453.25364.24043.dll,#1
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104

memory/2456-116-0x0000000073760000-0x00000000737E1000-memory.dmp

Download

memory/2456-118-0x0000000002F90000-0x0000000002F96000-memory.dmp

Download