dridex | bf3130e116fd5d9ae43a09831d59f66acee6cb0de1d657e80e711a2bb6397408

Analysis

Target
cc629318af63c61b89e0047c3799b3b5.dll
Size 524KB
Sample211222-slrmtafee7
SHA256 bf3130e116fd5d9ae43a09831d59f66acee6cb0de1d657e80e711a2bb6397408
MD5 cc629318af63c61b89e0047c3799b3b5
SHA1 410c533b229f6abefe72619451c248f107fff846
SHA512 3dcc446841757572df318bfc50a3860aecf16c17cb2f1b788409517bd51234de2d82efb5072f8c8138123f53972af49bf9e7016c330d7ae114fba3b4dfd33940
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2580-116-0x0000000073F80000-0x0000000074005000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	2580	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2580	2384	rundll32.exe	68
PID 2384 wrote to memory of 2580	2384	rundll32.exe	68
PID 2384 wrote to memory of 2580	2384	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc629318af63c61b89e0047c3799b3b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc629318af63c61b89e0047c3799b3b5.dll,#1
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:428

memory/2580-116-0x0000000073F80000-0x0000000074005000-memory.dmp

Download

memory/2580-118-0x00000000006E0000-0x00000000006E6000-memory.dmp

Download