Analysis
-
max time kernel
110s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:52
Static task
static1
General
-
Target
debf674237d9baca8caad240849f858959e5f0fe1f1693a05634d3e57d14539f.dll
-
Size
163KB
-
MD5
3ef0012d39d0fb46e7e14c412f436477
-
SHA1
c5f5c0d34fae216b6b9cba638e2abbeba65ab42a
-
SHA256
debf674237d9baca8caad240849f858959e5f0fe1f1693a05634d3e57d14539f
-
SHA512
567cb215ff00e2496e13bb749ffa22eafa975f218a02a738c7f948279386656bb5838da1999fbca8c359a5e3cfe49f30d5fbf8fa63a16601054e77f873718e69
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
43.229.206.212:443
82.209.17.209:8172
162.241.209.225:4125
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/416-115-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3284 416 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe 3284 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3284 WerFault.exe Token: SeBackupPrivilege 3284 WerFault.exe Token: SeDebugPrivilege 3284 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 512 wrote to memory of 416 512 rundll32.exe rundll32.exe PID 512 wrote to memory of 416 512 rundll32.exe rundll32.exe PID 512 wrote to memory of 416 512 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\debf674237d9baca8caad240849f858959e5f0fe1f1693a05634d3e57d14539f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\debf674237d9baca8caad240849f858959e5f0fe1f1693a05634d3e57d14539f.dll,#12⤵PID:416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284