Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 23:12
Static task
static1
General
-
Target
39174b5cc7e1f6a79b6bf727ace6b98991c66918e93fb65adb03d24e1cfc4e2c.dll
-
Size
158KB
-
MD5
92c9683a1c7fcf686c03c2ae359eb85c
-
SHA1
99064e59a4802376b40fe64e9bbca7bea37d4eca
-
SHA256
39174b5cc7e1f6a79b6bf727ace6b98991c66918e93fb65adb03d24e1cfc4e2c
-
SHA512
11cd30cf2d290f90f10e3291a4dd8a0fd6076e0b62d14fd096a842f2a7b55e879ae94618dfe103a5f8cb52a2c97b3ca13d91e4730d668b28e6654145b3941bc6
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/608-115-0x0000000073550000-0x000000007357D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 800 wrote to memory of 608 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 608 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 608 800 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39174b5cc7e1f6a79b6bf727ace6b98991c66918e93fb65adb03d24e1cfc4e2c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39174b5cc7e1f6a79b6bf727ace6b98991c66918e93fb65adb03d24e1cfc4e2c.dll,#12⤵
- Checks whether UAC is enabled