Analysis

  • max time kernel
    119s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-12-2021 23:19

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll

  • Size

    468KB

  • MD5

    1fb4f42e369bea3b8571a3b562125601

  • SHA1

    16e5a0b04989f7516d5fd0c55a027382808d1254

  • SHA256

    7cc0d16fe4e01e60f5eed66d1d6e58a9143129e8326cb16f8126664ce821f2d1

  • SHA512

    606f58fa3be337181bd5b12f720a4f710c686dded040ac83522070ae07c1c60b7935a162a08b2c1030932706786b05f144bd63dca1a5bda6e3ecb297d183822c

Malware Config

Extracted

Family

dridex

Botnet

22206

C2

120.50.40.185:443

139.59.14.223:8172

121.40.104.209:6602

139.162.113.169:593

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 248
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/524-59-0x0000000000000000-mapping.dmp
  • memory/524-60-0x0000000000280000-0x0000000000281000-memory.dmp
    Filesize

    4KB

  • memory/1916-54-0x0000000000000000-mapping.dmp
  • memory/1916-55-0x0000000075F21000-0x0000000075F23000-memory.dmp
    Filesize

    8KB

  • memory/1916-56-0x0000000074840000-0x00000000748B6000-memory.dmp
    Filesize

    472KB

  • memory/1916-58-0x00000000001F0000-0x00000000001F6000-memory.dmp
    Filesize

    24KB