dridex | c1decc725d0683a1e4110f708afbe9622450f7490ca1882d78a3233e0e8f32ac

Analysis

Target

Dridex_07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71.dll
Size

532KB
MD5

9e01fd2137e4b2b6e5bec3c7e3e40a77
SHA1

da6ef7a2e64e977b43801e75c2f063ca7094dc3f
SHA256

07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71
SHA512

4e47f592ab935097fb908459d6ffb5112266ba92c76d26ac049af5658c56afbf25f53417b7543340296268ef28c15d3dd0666f2fd55cad2f546bf43e4ce523a1

Score

10^/10

Family

dridex

Botnet

22201

144.91.122.102:443

85.10.248.28:593

185.4.135.27:5228

80.211.3.13:8116

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/2660-131-0x0000000075660000-0x00000000756E7000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4392 2660 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4392	2660	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4332 wrote to memory of 2660	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 2660	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 2660	4332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dridex_07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dridex_07c08b4a043b8bc8bea97f36414ae42ade74a37c4d5542727fe6fb0644a48a71.dll,#1
2⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 624
3⤵
- Program crash
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 2660
1⤵
PID:4280

memory/2660-130-0x0000000000000000-mapping.dmp

Download
memory/2660-131-0x0000000075660000-0x00000000756E7000-memory.dmp

Filesize
540KB

Download
memory/2660-133-0x00000000010D0000-0x00000000010D6000-memory.dmp

Filesize
24KB

Download