Analysis
-
max time kernel
82s -
max time network
83s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 18:07
Static task
static1
General
-
Target
051a9dfb36c346796dd4cb3f52320ec05e2dd7165fb5ee9ea06e95725872912c.dll
-
Size
154KB
-
MD5
1d55ee51222c50a41620861a15ef9c30
-
SHA1
a360efd86b64e249209220b7d3244d6ddf288415
-
SHA256
051a9dfb36c346796dd4cb3f52320ec05e2dd7165fb5ee9ea06e95725872912c
-
SHA512
13991bebfe6eed26e12df6f1bb4c9d09193909608650945df84c1edd2adeb8c270f2c7cfcfcab61ef9823cbd9085de4b80990f4cc99ee5019e6b1bf5207c4188
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
159.8.59.82:443
51.91.156.39:2303
67.196.50.240:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1724-115-0x0000000073A90000-0x0000000073ABD000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3904 wrote to memory of 1724 3904 rundll32.exe rundll32.exe PID 3904 wrote to memory of 1724 3904 rundll32.exe rundll32.exe PID 3904 wrote to memory of 1724 3904 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\051a9dfb36c346796dd4cb3f52320ec05e2dd7165fb5ee9ea06e95725872912c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\051a9dfb36c346796dd4cb3f52320ec05e2dd7165fb5ee9ea06e95725872912c.dll,#12⤵
- Checks whether UAC is enabled