dridex | 0e16f533d18ae86ab8cadc43a44e9ff7fd6586658939b6c60d6ed9201c31f33a

Analysis

Target

s7yzrmv13.dll
Size

476KB
MD5

b9df50a14d692e7aac5cf697462379f0
SHA1

0ac013a74fa5f75313774fb1c5294a4e0b9a3a75
SHA256

0e16f533d18ae86ab8cadc43a44e9ff7fd6586658939b6c60d6ed9201c31f33a
SHA512

eeb54214a759e8daef83d0197495b6985db5f37a5a6d8ba3ab941157ded0c149eb6ae3ee930fe7ec5fd22aaee009d0a33c419a9557d4db53c1077c10cb070a9b

Score

10^/10

Family

dridex

Botnet

10444

23.246.204.126:443

151.106.39.36:8116

103.124.144.123:6891

172.105.78.60:4664

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/832-132-0x0000000075850000-0x00000000758C9000-memory.dmp	dridex_ldr

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3988 832 WerFault.exe rundll32.exe
3568 832 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3988	832	WerFault.exe	rundll32.exe
3568	832	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1112 wrote to memory of 832	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 832	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 832	1112	rundll32.exe	rundll32.exe
PID 832 wrote to memory of 3988	832	rundll32.exe	WerFault.exe
PID 832 wrote to memory of 3988	832	rundll32.exe	WerFault.exe
PID 832 wrote to memory of 3988	832	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s7yzrmv13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s7yzrmv13.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 700
3⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 700
3⤵
- Program crash
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 832 -ip 832
1⤵
PID:4384

memory/832-130-0x0000000000000000-mapping.dmp

Download
memory/832-131-0x0000000000C00000-0x0000000000C06000-memory.dmp

Filesize
24KB

Download
memory/832-132-0x0000000075850000-0x00000000758C9000-memory.dmp

Filesize
484KB

Download
memory/832-134-0x0000000000C00000-0x0000000000C06000-memory.dmp

Filesize
24KB

Download
memory/3988-135-0x0000000000000000-mapping.dmp

Download