Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 18:08
Static task
static1
General
-
Target
6297bef1641cb6470c4c790f75088a766a10ad581c73a955a9bd06b60e368a92.dll
-
Size
154KB
-
MD5
826f49984d09f9bacaa176dc8038934e
-
SHA1
1d4880beb9d4200c9e36604591bc4c286ddaf080
-
SHA256
6297bef1641cb6470c4c790f75088a766a10ad581c73a955a9bd06b60e368a92
-
SHA512
11bdd8c3445f785cdc011e4b6a6057723625cdddebe19fe82a11617efd89fe2d455b4b9bc535ef816f38675ef7a2afaab6c077685a8f3b3e4ffa5d5671fecdfd
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
159.8.59.82:443
51.91.156.39:2303
67.196.50.240:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3172-115-0x0000000073AA0000-0x0000000073ACD000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3992 wrote to memory of 3172 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 3172 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 3172 3992 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6297bef1641cb6470c4c790f75088a766a10ad581c73a955a9bd06b60e368a92.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6297bef1641cb6470c4c790f75088a766a10ad581c73a955a9bd06b60e368a92.dll,#12⤵
- Checks whether UAC is enabled