Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 12:09
Static task
static1
General
-
Target
39657f13c0a91885eb1e38c789fc15e98215f68dfbd1c1bb48db9728199289e5.dll
-
Size
162KB
-
MD5
aba2024042cc10c4f39b327be2c6af0b
-
SHA1
66eb980a4cb8c93fcd42067ac0f643e7a3ba3640
-
SHA256
39657f13c0a91885eb1e38c789fc15e98215f68dfbd1c1bb48db9728199289e5
-
SHA512
7f493b2166135de50079b469fbac628c340f13e09ce313b33c664cd3120c1d2ff9d54ae34b3a74b0831714b1fbf3d1e4dfff6cd8364a245c301bc8e56e0a3371
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/4788-115-0x0000000073C30000-0x0000000073C5E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4652 wrote to memory of 4788 4652 rundll32.exe rundll32.exe PID 4652 wrote to memory of 4788 4652 rundll32.exe rundll32.exe PID 4652 wrote to memory of 4788 4652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39657f13c0a91885eb1e38c789fc15e98215f68dfbd1c1bb48db9728199289e5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39657f13c0a91885eb1e38c789fc15e98215f68dfbd1c1bb48db9728199289e5.dll,#12⤵
- Checks whether UAC is enabled