dridex | 5db038c01afd165aafb9842e1677800c07df7cd8607f5e6eeb7ee2b62be48700

Analysis

Target
SecuriteInfo.com.W32.AIDetect.malware2.6729.19086.dll
Size 532KB
Sample211222-wprnrsfgh2
SHA256 5db038c01afd165aafb9842e1677800c07df7cd8607f5e6eeb7ee2b62be48700
MD5 25054c400012c94d03ba48102567d0a0
SHA1 d5d3eb1dc456b9426305afcd8085bc4bcdfbd4d5
SHA512 0f60e30fa2092c786b1cf0dbcb0fb36da884ca9fcdf8eefa31f100434e758bc84ec145cf894a8c7ff1a9d159caf490e20cbdc4e888d44d180b94d536c68d83da
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2124-119-0x0000000073D60000-0x0000000073DE6000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	2124	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2124	916	rundll32.exe	69
PID 916 wrote to memory of 2124	916	rundll32.exe	69
PID 916 wrote to memory of 2124	916	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.6729.19086.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.6729.19086.dll,#1
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408

memory/2124-119-0x0000000073D60000-0x0000000073DE6000-memory.dmp

Download

memory/2124-121-0x00000000007E0000-0x00000000007E6000-memory.dmp

Download