Analysis
-
max time kernel
104s -
max time network
105s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 18:00
Static task
static1
General
-
Target
0cf55152a0d6f47f60f75d98979b98012558d81005b559551ef58cd6d4a070ba.dll
-
Size
157KB
-
MD5
602b3e2a5c45e5fe055e283d8188e9cf
-
SHA1
75817a39f99828720e1a52f83d28faa3fcbaae90
-
SHA256
0cf55152a0d6f47f60f75d98979b98012558d81005b559551ef58cd6d4a070ba
-
SHA512
72f49594cf55c1de47256cdf4826d95db7ef7a72b512aca6dbbc239efa6365205948f22f0f184a6bcde64281ede60090d1ad12b1279541928ffe98d6d742c433
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
159.8.59.82:443
51.91.156.39:2303
67.196.50.240:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2220-115-0x0000000074420000-0x000000007444D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2116 wrote to memory of 2220 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2220 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2220 2116 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf55152a0d6f47f60f75d98979b98012558d81005b559551ef58cd6d4a070ba.dll,#11⤵
- Checks whether UAC is enabled
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf55152a0d6f47f60f75d98979b98012558d81005b559551ef58cd6d4a070ba.dll,#11⤵
- Suspicious use of WriteProcessMemory