dridex | 37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17

Analysis

Target

37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe
Size

204KB
MD5

6f4dd2a1f71aa0f3dd7ce2c8555a5087
SHA1

5b209fff8c98ae6dd57dceef062201896d28d3b7
SHA256

37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17
SHA512

8360c2e9aca4bdebbe1b5912eb2a2f32f3111d1d618ae8d63f72cb7e13ed51bb8ff1940f3859428841b1b92a1ef38a15b07f2361d71fc25573d1f650253c61ab

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

pid	process
3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe
3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe
3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe
3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

description pid process

Token: SeRestorePrivilege 3616 37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

description	pid	process
Token: SeRestorePrivilege	3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe

description	pid	process	target process
PID 3616 wrote to memory of 444	3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe	raserver.exe
PID 3616 wrote to memory of 444	3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe	raserver.exe
PID 3616 wrote to memory of 444	3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe	raserver.exe
PID 3616 wrote to memory of 444	3616	37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\37189d1aa76f7b002c13bcf99324ee14f4125e08fb62ceb1ca6a452d22952b17.exe"
2⤵
PID:444

memory/444-133-0x0000000000000000-mapping.dmp

Download
memory/444-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/444-145-0x0000000001250000-0x0000000001256000-memory.dmp

Filesize
24KB

Download
memory/3616-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3616-132-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download