dridex | 1a560adb810b924e65f91e34664166be2c2adac10f7f28c075d902e4adb1112c

General

Target

SecuriteInfo.com.W32.AIDetect.malware2.31993.22306.dll
Size

175KB
MD5

65638d179046f7caec06dc03e508b040
SHA1

351ee428ccaa279257ac8fc493eafc62beda580b
SHA256

1a560adb810b924e65f91e34664166be2c2adac10f7f28c075d902e4adb1112c
SHA512

c17078c4555cac26a501c81c13a4214b1934b097a925862da7e0b2abb1d959f997cb8fbfaa19b20be1d761fad7218a915d907e7f2b7fe4f0f84b471a93c3e526

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1136-62-0x0000000074610000-0x0000000074640000-memory.dmp	dridex_ldr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1576 1136 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1576 WerFault.exe
1576 WerFault.exe
1576 WerFault.exe
1576 WerFault.exe
1576 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1576 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1576 WerFault.exe

pid	pid_target	process	target process
1576	1136	WerFault.exe	rundll32.exe

pid	process
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe

pid	process
1576	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1576	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1136	1724	rundll32.exe	rundll32.exe
PID 1136 wrote to memory of 1576	1136	rundll32.exe	WerFault.exe
PID 1136 wrote to memory of 1576	1136	rundll32.exe	WerFault.exe
PID 1136 wrote to memory of 1576	1136	rundll32.exe	WerFault.exe
PID 1136 wrote to memory of 1576	1136	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.31993.22306.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.31993.22306.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 224
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-60-0x0000000000000000-mapping.dmp

Download
memory/1136-61-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1136-62-0x0000000074610000-0x0000000074640000-memory.dmp

Filesize
192KB

Download
memory/1136-65-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/1576-64-0x0000000000000000-mapping.dmp

Download
memory/1576-66-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing