dridex | 96122fb865d9d5e150fdbd1c04240e786a3c16528cd33748464eade4ea6d9986

Analysis

Target
5046d830d8506f9c454d1ebccc27420c.dll
Size 512KB
Sample211220-v2j9sabda8
SHA256 96122fb865d9d5e150fdbd1c04240e786a3c16528cd33748464eade4ea6d9986
MD5 5046d830d8506f9c454d1ebccc27420c
SHA1 a7f4597e1d2570ab89e23e696a5e009ea7a23112
SHA512 0cdc5da21a338c5cbdc493e1b4ac8a7f9e7a3d657ecb5f1f90ca749f48064317d248a18ddd77417ff198d7594162d5ec0f6676aadb59f42a6a87086866060561
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3484-119-0x0000000073640000-0x00000000736C1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	3484	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3484	3412	rundll32.exe	68
PID 3412 wrote to memory of 3484	3412	rundll32.exe	68
PID 3412 wrote to memory of 3484	3412	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5046d830d8506f9c454d1ebccc27420c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5046d830d8506f9c454d1ebccc27420c.dll,#1
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4256

memory/3484-119-0x0000000073640000-0x00000000736C1000-memory.dmp

Download

memory/3484-121-0x00000000005F0000-0x00000000005F6000-memory.dmp

Download