dridex | 715b1639199a7bac9ccecc2d174c5e794b5edb6ffec3b72af7b904f0683d9f49

Analysis

Target

ijlog1gmo.dll
Size

476KB
MD5

adcf8e3ae302ab46c26836a4d0ee2768
SHA1

e467099b5fd82d7989e33169f3a1979776fc28a3
SHA256

715b1639199a7bac9ccecc2d174c5e794b5edb6ffec3b72af7b904f0683d9f49
SHA512

4e0f7d31cad387cdee5b73c36e0e11a64676d2b04cdedc26e375398780f1af99c7ec55616570d1fefc0016b685c96558e8d85c2aa6b9453fd41148a47e79258d

Score

10^/10

Family

dridex

Botnet

10444

23.246.204.126:443

151.106.39.36:8116

103.124.144.123:6891

172.105.78.60:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/920-131-0x00000000749A0000-0x0000000074A19000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 920 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3984	920	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4576 wrote to memory of 920	4576	rundll32.exe	rundll32.exe
PID 4576 wrote to memory of 920	4576	rundll32.exe	rundll32.exe
PID 4576 wrote to memory of 920	4576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ijlog1gmo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ijlog1gmo.dll,#1
2⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 700
3⤵
- Program crash
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 920 -ip 920
1⤵
PID:3908

memory/920-130-0x0000000000000000-mapping.dmp

Download
memory/920-131-0x00000000749A0000-0x0000000074A19000-memory.dmp

Filesize
484KB

Download
memory/920-133-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download