Analysis
-
max time kernel
38s -
max time network
46s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 18:04
Static task
static1
General
-
Target
fafaef8a256d8eb3c1b69d040ae76ca59e21bde9c05d52a7d37ce0be614d9ff8.dll
-
Size
157KB
-
MD5
1a0ae08753caf73f0d54a6b215ab3991
-
SHA1
c057e7bbde321d62dee485f33f89d96a3f81edfe
-
SHA256
fafaef8a256d8eb3c1b69d040ae76ca59e21bde9c05d52a7d37ce0be614d9ff8
-
SHA512
3b1c85118f7d419bf0dbf5f264c62ac3bffb2afc1221625b5e6d92f9b87c200e8402ae8720db9aab6e78884bda93b93f67fd14ab7e64b2c7c6d4730938e3ed6b
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
159.8.59.82:443
51.91.156.39:2303
67.196.50.240:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3600-115-0x0000000073B70000-0x0000000073B9D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2112 wrote to memory of 3600 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 3600 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 3600 2112 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fafaef8a256d8eb3c1b69d040ae76ca59e21bde9c05d52a7d37ce0be614d9ff8.dll,#11⤵
- Checks whether UAC is enabled
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fafaef8a256d8eb3c1b69d040ae76ca59e21bde9c05d52a7d37ce0be614d9ff8.dll,#11⤵
- Suspicious use of WriteProcessMemory