dridex | 5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e

Analysis

max time kernel
101s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 13:52

Target

5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe
Size

204KB
MD5

5433d8ae94d18b1717d373dc9c73c4de
SHA1

23c30177ec268b76f7b73282b184e3a7ed2dd830
SHA256

5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e
SHA512

5c8e1fdc1e2eaac7a9452f314c60400affdb40ec444f19db794d96bef08d5133c2f81b71e91bea2bde31d4526fa66c94442d2bfeb8c1e02baa55b8f73268770c

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

pid	process
1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe
1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe
1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe
1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

description pid process

Token: SeRestorePrivilege 1328 5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

description	pid	process
Token: SeRestorePrivilege	1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe

description	pid	process	target process
PID 1328 wrote to memory of 1316	1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe	raserver.exe
PID 1328 wrote to memory of 1316	1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe	raserver.exe
PID 1328 wrote to memory of 1316	1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe	raserver.exe
PID 1328 wrote to memory of 1316	1328	5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\5884e6b47a289116c08e6cfc2667f3cff395df5c65479c1428de8e8b2b7bd37e.exe"
2⤵
PID:1316

memory/1316-133-0x0000000000000000-mapping.dmp

Download
memory/1316-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1316-145-0x0000000000E40000-0x0000000000E46000-memory.dmp

Filesize
24KB

Download
memory/1328-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/1328-132-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download