dridex | f8dfd17a7ffb6fba87152b11f34ff39cbc29b8661316b9a2f95b9a28af2af9d4

Analysis

Target
90c3ad4c45344f432c089b4d544a7ca4.dll
Size 512KB
Sample211220-vreasabcg3
SHA256 f8dfd17a7ffb6fba87152b11f34ff39cbc29b8661316b9a2f95b9a28af2af9d4
MD5 90c3ad4c45344f432c089b4d544a7ca4
SHA1 58f53d52c9576c2205a0addc6c1a4d9025c07536
SHA512 3f5f9f9cf0f99e53647837e1f9746c9cbf4ef697b8c8e77aae90870867e82909acdba8e61f72bd762a99baaea5817ffa72171b415ed4574c33b88232302a2f36
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2640-116-0x0000000073BF0000-0x0000000073C71000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2640	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2640	2448	rundll32.exe	69
PID 2448 wrote to memory of 2640	2448	rundll32.exe	69
PID 2448 wrote to memory of 2640	2448	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c3ad4c45344f432c089b4d544a7ca4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c3ad4c45344f432c089b4d544a7ca4.dll,#1
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 684
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364

memory/2640-116-0x0000000073BF0000-0x0000000073C71000-memory.dmp

Download

memory/2640-118-0x0000000002C70000-0x0000000002C76000-memory.dmp

Download