dridex | 2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a

Analysis

Target

2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe
Size

204KB
MD5

86c8fbc8a761d1a930efd36927d11bbf
SHA1

b53593002b8ef1bfb263945d5aa3d2a66560e96c
SHA256

2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a
SHA512

95f1413a77bd02979f60c869a692a51eb876e54f28fda82c0e94f42cb77687e8ab537a1c98bc4fb21d13eeb6eeb68d0ac39547d0c342969b794eff4186431309

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe

description pid process

Token: SeRestorePrivilege 3688 2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe

description	pid	process
Token: SeRestorePrivilege	3688	2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe

description	pid	process	target process
PID 3688 wrote to memory of 4912	3688	2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe	raserver.exe
PID 3688 wrote to memory of 4912	3688	2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe	raserver.exe
PID 3688 wrote to memory of 4912	3688	2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe	raserver.exe
PID 3688 wrote to memory of 4912	3688	2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\2bdbd2b659891905503f1ae2412a29f43bc27a10de284387d01c3d7404a25c5a.exe"
2⤵
PID:4912

memory/3688-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3688-132-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/4912-133-0x0000000000000000-mapping.dmp

Download
memory/4912-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4912-145-0x0000000002B50000-0x0000000002B56000-memory.dmp

Filesize
24KB

Download