dridex | d0275ec5e9ecaa584f4834bf4882853bfa5b806f684635388b429dc1487d1ae1

Analysis

Target
SecuriteInfo.com.W32.AIDetect.malware1.4497.31777.dll
Size 532KB
Sample211222-wqa3eafgh5
SHA256 d0275ec5e9ecaa584f4834bf4882853bfa5b806f684635388b429dc1487d1ae1
MD5 57db300568a2d596a3d0372f943129a3
SHA1 43c9fa8741041ac6438b7889f175c4dde849208c
SHA512 acb910cea33d79fec35f6cdc450e12d340c8f17c5bd61582fe61d0e21d2a0fbc00b7631dee6a2514f3122a58688b3bbc9bf26e0a195c39e2b8cdba3ed5f61eaa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rc4.plain

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2400-116-0x00000000735C0000-0x0000000073647000-memory.dmp	dridex_ldr

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2400	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 2400	680	rundll32.exe	69
PID 680 wrote to memory of 2400	680	rundll32.exe	69
PID 680 wrote to memory of 2400	680	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.4497.31777.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.4497.31777.dll,#1
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2512

memory/2400-116-0x00000000735C0000-0x0000000073647000-memory.dmp

Download

memory/2400-118-0x0000000000C60000-0x0000000000C66000-memory.dmp

Download