Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 14:17
Static task
static1
General
-
Target
4bb0a1a8e5e5396f2fd4c4752b1244390a4a57d0354954fc227363f31b481fb0.dll
-
Size
162KB
-
MD5
7057f79b137b7824a9bed13a2870595a
-
SHA1
e47de222bd899f95ba004c2cf589902cdc53daba
-
SHA256
4bb0a1a8e5e5396f2fd4c4752b1244390a4a57d0354954fc227363f31b481fb0
-
SHA512
8262bdcd92357833a9cb1947a48e58c77289593a9c281bfed11aec1caf6587ebfc9f22cd46ff980753252c7c696878b5b4fabb922c825b790604f8b35f432835
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/508-115-0x0000000073F20000-0x0000000073F4E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4044 wrote to memory of 508 4044 rundll32.exe rundll32.exe PID 4044 wrote to memory of 508 4044 rundll32.exe rundll32.exe PID 4044 wrote to memory of 508 4044 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a1a8e5e5396f2fd4c4752b1244390a4a57d0354954fc227363f31b481fb0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a1a8e5e5396f2fd4c4752b1244390a4a57d0354954fc227363f31b481fb0.dll,#12⤵
- Checks whether UAC is enabled