dridex | 2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f

Analysis

Target

2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe
Size

140KB
MD5

601d46a64067ba35c0256b1ba158a83c
SHA1

26d2a086ed23c72f65a6912d9ca9f6950038b9c2
SHA256

2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f
SHA512

c4684ec29e3758b22340dba80232330e6377583712bbb5e6512bbddac508593694d8e626fbe46351f94ad97e7fadfb2de6d705c236bb48b0892c842fc0a6726f

Score

10^/10

dridex botnet

Family

dridex

46.105.131.67:443

67.207.148.158:443

184.106.153.73:443

208.78.100.202:1801

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe

description pid process

Token: SeRestorePrivilege 3472 2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe

description	pid	process
Token: SeRestorePrivilege	3472	2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe

description	pid	process	target process
PID 3472 wrote to memory of 4184	3472	2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe	raserver.exe
PID 3472 wrote to memory of 4184	3472	2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe	raserver.exe
PID 3472 wrote to memory of 4184	3472	2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe	raserver.exe
PID 3472 wrote to memory of 4184	3472	2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\2f0346c831ff31d44908129df783ffa4bde5638a3e943d91330a3415805fd70f.exe"
2⤵
PID:4184

memory/3472-131-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/3472-130-0x00000000027C0000-0x00000000027E3000-memory.dmp

Filesize
140KB

Download
memory/4184-133-0x0000000000000000-mapping.dmp

Download
memory/4184-134-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-135-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-136-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-137-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-138-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-139-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-140-0x0000000003000000-0x0000000003023000-memory.dmp

Filesize
140KB

Download
memory/4184-145-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download