Analysis
-
max time kernel
57s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 14:09
Static task
static1
Behavioral task
behavioral1
Sample
63a2d30d0ca394f2775a5643da4020c25d86708a8835d52faaa64beab61b38c8.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
63a2d30d0ca394f2775a5643da4020c25d86708a8835d52faaa64beab61b38c8.dll
-
Size
162KB
-
MD5
08988aaa705e83448a94a3ae5c028bfe
-
SHA1
28ced630ad2ba9a23dc2f3463390d75e1cafe0f9
-
SHA256
63a2d30d0ca394f2775a5643da4020c25d86708a8835d52faaa64beab61b38c8
-
SHA512
ef18a93a289275675cc5a4a8c123579762f4b26cc7523b850ea59f5ca30c0463945ee766485a6c2ea0ea7f5c74885740547202bd991cd43750ffed66a6cc4163
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3720-115-0x0000000073AA0000-0x0000000073ACE000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2016 wrote to memory of 3720 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 3720 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 3720 2016 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63a2d30d0ca394f2775a5643da4020c25d86708a8835d52faaa64beab61b38c8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63a2d30d0ca394f2775a5643da4020c25d86708a8835d52faaa64beab61b38c8.dll,#12⤵
- Checks whether UAC is enabled
PID:3720