dridex | f9efeb3e890f09f571e0d349394140e49237bfea1cf8e7ee7b8768cb008cde51

Analysis

Target
5de161f52f3a533504071ff38ad053d6.dll
Size 512KB
Sample211220-vqvalscbcp
SHA256 f9efeb3e890f09f571e0d349394140e49237bfea1cf8e7ee7b8768cb008cde51
MD5 5de161f52f3a533504071ff38ad053d6
SHA1 5d5dc500f9d37836d38a7282beb80271653685c6
SHA512 9cec18a4be9c1e341e0b5f95ade062af123f5f09828fcfbc0b659aeefc66cedad3eb1f83fc039fc97275825f8ae047bc8a96c7478de34a1f0a0bcf72083a5687
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3608-119-0x0000000073640000-0x00000000736C1000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	3608	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3608	3404	rundll32.exe	68
PID 3404 wrote to memory of 3608	3404	rundll32.exe	68
PID 3404 wrote to memory of 3608	3404	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5de161f52f3a533504071ff38ad053d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5de161f52f3a533504071ff38ad053d6.dll,#1
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4396

memory/3608-119-0x0000000073640000-0x00000000736C1000-memory.dmp

Download

memory/3608-121-0x0000000000E40000-0x0000000000E46000-memory.dmp

Download