dridex | 999285b1dae2c26e61557b12e3f60dc6135dfb185c0136cb1e2f441149bfea40

Analysis

Target
2c72032fa31506ccdca8812baa524300.dll
Size 512KB
Sample211220-vreasabcg4
SHA256 999285b1dae2c26e61557b12e3f60dc6135dfb185c0136cb1e2f441149bfea40
MD5 2c72032fa31506ccdca8812baa524300
SHA1 b080893b4a51b01b951ad378c4b32b9736d82338
SHA512 e459c060cd8b90020e4f982e9c9b58cd3dbb189cb5feaa5f2cfb1fcb7ae6842e9c7898578f189d0f1056ff7dd75b2cedb5499fd58a584d2c76a919e29c38c11a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2820-117-0x0000000073BF0000-0x0000000073C71000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
524	2820	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2820	2736	rundll32.exe	68
PID 2736 wrote to memory of 2820	2736	rundll32.exe	68
PID 2736 wrote to memory of 2820	2736	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c72032fa31506ccdca8812baa524300.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c72032fa31506ccdca8812baa524300.dll,#1
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:524

memory/2820-116-0x0000000002FE0000-0x0000000002FE6000-memory.dmp

Download

memory/2820-117-0x0000000073BF0000-0x0000000073C71000-memory.dmp

Download