Analysis
-
max time kernel
29s -
max time network
123s -
platform
windows10_x64 -
resource
win10 -
submitted
24-09-2020 07:38
Static task
static1
Behavioral task
behavioral1
Sample
DRIDEX (1).dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
DRIDEX (1).dll
-
Size
320KB
-
MD5
b944c443789ddd25f9561899a59ea54c
-
SHA1
26f894c5c30691f4c9046bccc7059f190b926782
-
SHA256
dd39accfa55be48b2c14f264a5917ead4964b8a7ce7f3f113cc74d13f87e86e7
-
SHA512
cc41f6958d69d11e43fce2f8e9834267db8d09fa06ca24816b9ef8db90eb38c7b2e456f09d3336448081acfc40233c3c7b73d52214d6142c541dea0d420c0098
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3892-1-0x0000000073FC0000-0x0000000073FFD000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 3024 wrote to memory of 3892 3024 rundll32.exe 67 PID 3024 wrote to memory of 3892 3024 rundll32.exe 67 PID 3024 wrote to memory of 3892 3024 rundll32.exe 67