Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 18:03
Static task
static1
General
-
Target
0234c6b41c2dab2afef32d6ae43b160b7fa4286384ce3821334b8363386d0dbc.dll
-
Size
157KB
-
MD5
a3e758bdfd187fa13762041e7d3c68c2
-
SHA1
d8cb8f05508911861914beb651c7cc4f987e358a
-
SHA256
0234c6b41c2dab2afef32d6ae43b160b7fa4286384ce3821334b8363386d0dbc
-
SHA512
83e4caf53131811d1efdb32203666f6b648653ab3f1c38678e5812806c84a54b9008dbeaa569616cb7b2cb8c9c83518b68f1a289c8ce4983a236995b34fb381a
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
159.8.59.82:443
51.91.156.39:2303
67.196.50.240:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1632-115-0x0000000074440000-0x000000007446D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 808 wrote to memory of 1632 808 rundll32.exe rundll32.exe PID 808 wrote to memory of 1632 808 rundll32.exe rundll32.exe PID 808 wrote to memory of 1632 808 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0234c6b41c2dab2afef32d6ae43b160b7fa4286384ce3821334b8363386d0dbc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0234c6b41c2dab2afef32d6ae43b160b7fa4286384ce3821334b8363386d0dbc.dll,#12⤵
- Checks whether UAC is enabled
PID:1632