dridex | 2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512

Analysis

Target

2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe
Size

204KB
MD5

47481aba4f76a2be94163b8bf2d7630b
SHA1

b86e41ec0c0a33e0c0da7a83f5e04fc322f82770
SHA256

2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512
SHA512

5be27dae776e75ad8a892066d736619a9a0c5203aa5fedc1a9a4c162320344cdec0fc7aafeb84aa5ca3018e6da53b06c2b2f2056e5f8208370269b97f609eb34

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

pid	process
4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe
4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe
4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe
4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

description pid process

Token: SeRestorePrivilege 4580 2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

description	pid	process
Token: SeRestorePrivilege	4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe

description	pid	process	target process
PID 4580 wrote to memory of 456	4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe	raserver.exe
PID 4580 wrote to memory of 456	4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe	raserver.exe
PID 4580 wrote to memory of 456	4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe	raserver.exe
PID 4580 wrote to memory of 456	4580	2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\2d22db0717b7d3c798684dfa4df5b49d5de52682fabec6889a64206b4c916512.exe"
2⤵
PID:456

memory/456-133-0x0000000000000000-mapping.dmp

Download
memory/456-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/456-145-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/4580-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4580-132-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download