dridex | f54781f5c41ce33227923791ecfd591cb0cbfd446d0d537ca5b2e9477cbf6da3

Analysis

Target
SecuriteInfo.com.W32.AIDetect.malware1.26959.155.dll
Size 532KB
Sample211222-wprc1afgg4
SHA256 f54781f5c41ce33227923791ecfd591cb0cbfd446d0d537ca5b2e9477cbf6da3
MD5 c08b8320332d85132eb961c85f92152d
SHA1 cc93f8dfd22b6120efc51be65c63c30807d05306
SHA512 3f01c9fe136db19933034978d03cf9924d583d1d516feafd80abf7b160587bb8ca2529258a4bc13d896b012acbabdf3087594ad123f4de5fc9a02eee391ef887
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/668-116-0x0000000073760000-0x00000000737E7000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
708	668	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 668	3312	rundll32.exe	69
PID 3312 wrote to memory of 668	3312	rundll32.exe	69
PID 3312 wrote to memory of 668	3312	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.26959.155.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.26959.155.dll,#1
  2⤵
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:708

memory/668-116-0x0000000073760000-0x00000000737E7000-memory.dmp

Download

memory/668-118-0x00000000042E0000-0x00000000042E6000-memory.dmp

Download