dridex | 0c35f5b724faaa4d0f4f17f62272610047408b381df876067c98fca735a3682d

Analysis

max time kernel
1471s
max time network
1504s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
04-12-2023 17:56

Target

The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Size

140KB
MD5

925da3a10f7dde802c8d87047b14fda6
SHA1

1fc59fbf692f690b9fe82cfafc9dcbd5aac31a68
SHA256

c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
SHA512

82588188de13f34cd751da7409f780c4fc5814da780fe8cad1fa73370414fb24b9822fc56f1f162d0db4a5c27159c225bc4d4fb061a87cb3c0d89b067353a478
SSDEEP

3072:X9z9zjy6WEba5uuoLPhiVF3NT5nNpytoQE:X9J9gu0td5nN4

Score

10^/10

dridex botnet

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2068	DridexDroppedVBS.exe
Token: SeCreatePagefilePrivilege	2068	DridexDroppedVBS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 492	2068	DridexDroppedVBS.exe	77
PID 2068 wrote to memory of 492	2068	DridexDroppedVBS.exe	77
PID 2068 wrote to memory of 492	2068	DridexDroppedVBS.exe	77
PID 2068 wrote to memory of 492	2068	DridexDroppedVBS.exe	77

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexDroppedVBS.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexDroppedVBS.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexDroppedVBS.exe"
  2⤵
  PID:492

memory/492-2-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/492-4-0x0000000076D40000-0x0000000076E30000-memory.dmp

Filesize
960KB

Download
memory/492-6-0x0000000076D40000-0x0000000076E30000-memory.dmp

Filesize
960KB

Download
memory/2068-0-0x0000000000370000-0x0000000000394000-memory.dmp

Filesize
144KB

Download
memory/2068-1-0x0000000001150000-0x0000000001156000-memory.dmp

Filesize
24KB

Download
memory/2068-5-0x0000000000370000-0x0000000000394000-memory.dmp

Filesize
144KB

Download