dridex | 28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b

Analysis

Target

28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe
Size

204KB
MD5

f0ad8405e5e9f488c20b351a4e455eb4
SHA1

84803ab7ca584b72bbb93b7335755656adfcaf4c
SHA256

28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b
SHA512

34abee83e561592aaf64e6d0a2fe9a95b2995ea81227abf23bedf6b70d8c849a8f22604a27c602bf6dba60352f066b993a1671e3699b51157558e2ca44d83907

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

pid	process
3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe
3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe
3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe
3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

description pid process

Token: SeRestorePrivilege 3360 28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

description	pid	process
Token: SeRestorePrivilege	3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe

description	pid	process	target process
PID 3360 wrote to memory of 2108	3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe	raserver.exe
PID 3360 wrote to memory of 2108	3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe	raserver.exe
PID 3360 wrote to memory of 2108	3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe	raserver.exe
PID 3360 wrote to memory of 2108	3360	28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\28acd91675de1d3a72385492abe024f9b4667e419b6798d9b1beedb0cf3db35b.exe"
2⤵
PID:2108

memory/2108-133-0x0000000000000000-mapping.dmp

Download
memory/2108-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/2108-145-0x0000000001060000-0x0000000001066000-memory.dmp

Filesize
24KB

Download
memory/3360-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3360-132-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download