dridex | c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80

Analysis

Target
triage_dropped_file.dll
Size 464KB
Sample211220-v91azabdc4
SHA256 c4ee2acc6b5aca21235917972c19d30c5585662b59decc6994c54d51bf5d5b80
MD5 143edeeb17658ee7a0bd3d20bc3bfeca
SHA1 0327e01ea4a9f08122cd69b49fbf4af020daf296
SHA512 e3307f31ab0ee55a1f7de6d2d96d7302fa1cf83a1099245457d4681d19b3a758803021582a25025b5925faf8eb8f8a039a51ef0ed3d19e038655b994f78080e3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3384-116-0x00000000742F0000-0x0000000074366000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	3384	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3384	3648	rundll32.exe	68
PID 3648 wrote to memory of 3384	3648	rundll32.exe	68
PID 3648 wrote to memory of 3384	3648	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 644
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:436

memory/3384-116-0x00000000742F0000-0x0000000074366000-memory.dmp

Download

memory/3384-118-0x0000000002950000-0x00000000029FE000-memory.dmp

Download