Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20-12-2021 23:19

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll

  • Size

    468KB

  • MD5

    1fb4f42e369bea3b8571a3b562125601

  • SHA1

    16e5a0b04989f7516d5fd0c55a027382808d1254

  • SHA256

    7cc0d16fe4e01e60f5eed66d1d6e58a9143129e8326cb16f8126664ce821f2d1

  • SHA512

    606f58fa3be337181bd5b12f720a4f710c686dded040ac83522070ae07c1c60b7935a162a08b2c1030932706786b05f144bd63dca1a5bda6e3ecb297d183822c

Malware Config

Extracted

Family

dridex

Botnet

22206

C2

120.50.40.185:443

139.59.14.223:8172

121.40.104.209:6602

139.162.113.169:593

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.2161.25481.dll,#1
      2⤵
        PID:3808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 644
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1132

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3808-115-0x0000000000000000-mapping.dmp
    • memory/3808-116-0x00000000740C0000-0x0000000074136000-memory.dmp
      Filesize

      472KB

    • memory/3808-118-0x00000000008D0000-0x00000000008D6000-memory.dmp
      Filesize

      24KB