dridex | 0341b7e0b66e27bee166ba1fd9fad700d85e58a257bbfed1b60a662d97fc1617

Analysis

Target
8337dd22aa86bc357f8bc573441a97c7.dll
Size 524KB
Sample211226-tlsqjsbfb9
SHA256 0341b7e0b66e27bee166ba1fd9fad700d85e58a257bbfed1b60a662d97fc1617
MD5 8337dd22aa86bc357f8bc573441a97c7
SHA1 6dc2600455a42651c95c3b612406dabd1182bfee
SHA512 6a2572851e1ef774c35bf733455db6450f0c668d907f6617363037cb92277a022878c6fe7e652d035ed08f75f60c4a6463508a5feb7afb9a866c28d13577748c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3600-116-0x00000000742E0000-0x0000000074365000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	3600	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3600	3528	rundll32.exe	68
PID 3528 wrote to memory of 3600	3528	rundll32.exe	68
PID 3528 wrote to memory of 3600	3528	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8337dd22aa86bc357f8bc573441a97c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8337dd22aa86bc357f8bc573441a97c7.dll,#1
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:64

memory/3600-116-0x00000000742E0000-0x0000000074365000-memory.dmp

Download

memory/3600-118-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Download