dridex | 38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444

Analysis

Target

38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe
Size

144KB
MD5

3e906b06ea4ee4955063b15647e80991
SHA1

a89e6526276181e5751c37aca7682ca6fc160d18
SHA256

38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444
SHA512

5f1b758e2ade1b10193b66f39814488d849491c6a776f32c58df18da623e1bc153d16b6357034f6721de0482255bf231837653d9f64b653f2db74a0a9275424b

Score

10^/10

dridex botnet

Family

dridex

162.243.158.154:443

51.255.50.164:1801

153.121.36.202:443

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe

description pid process

Token: SeRestorePrivilege 2600 38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe

description	pid	process
Token: SeRestorePrivilege	2600	38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe

description	pid	process	target process
PID 2600 wrote to memory of 3576	2600	38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe	raserver.exe
PID 2600 wrote to memory of 3576	2600	38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe	raserver.exe
PID 2600 wrote to memory of 3576	2600	38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe	raserver.exe
PID 2600 wrote to memory of 3576	2600	38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\38651a6d73335fe8613c78c9858b919d484b0d8c89409175767fced730499444.exe"
2⤵
PID:3576

memory/2600-130-0x0000000002590000-0x00000000025B4000-memory.dmp

Filesize
144KB

Download
memory/2600-132-0x00000000012B0000-0x00000000012B6000-memory.dmp

Filesize
24KB

Download
memory/3576-133-0x0000000000000000-mapping.dmp

Download
memory/3576-134-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-136-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-135-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-137-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-138-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-139-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-140-0x0000000003000000-0x0000000003024000-memory.dmp

Filesize
144KB

Download
memory/3576-145-0x00000000028A0000-0x00000000028A6000-memory.dmp

Filesize
24KB

Download