dridex | 4ff524afd1a400a671e67a3cae5d582bf9c1ea927f430b0b5debc73302c4865f

Analysis

Target
SecuriteInfo.com.W32.AIDetect.malware2.14259.25502.dll
Size 512KB
Sample211216-bg8xvsbaf6
SHA256 4ff524afd1a400a671e67a3cae5d582bf9c1ea927f430b0b5debc73302c4865f
MD5 140b099cf70359038007d7503beafbc3
SHA1 f32422214ed6dff351f867032d5948db17e0838f
SHA512 d2e19e8fa1691123cbe271e3185abff1da96b520be23d1ab01457761b45242ffb8af558e462053f9ef04401c903049317c72be4d45268a5638ef34aa36f3bce0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4484 created 3040	4484	WerFault.exe	69

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3040-119-0x0000000073F20000-0x0000000073FA2000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	3040	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3040	2140	rundll32.exe	69
PID 2140 wrote to memory of 3040	2140	rundll32.exe	69
PID 2140 wrote to memory of 3040	2140	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.14259.25502.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.14259.25502.dll,#1
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 656
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484

memory/3040-119-0x0000000073F20000-0x0000000073FA2000-memory.dmp

Download

memory/3040-121-0x0000000000B80000-0x0000000000B86000-memory.dmp

Download