Analysis
-
max time kernel
17s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-06-2021 02:16
Static task
static1
General
-
Target
3a9ebbe93fbdac80628a8e74c81b02993a491585d2e03f1e29bdc5eca935339a.dll
-
Size
163KB
-
MD5
fe367395a77d43491a3a4ccce1194842
-
SHA1
1f96f487ebf5360fb060e622be1e2453d7e43aba
-
SHA256
3a9ebbe93fbdac80628a8e74c81b02993a491585d2e03f1e29bdc5eca935339a
-
SHA512
f3d66bf137c349c43cffee40981ab234e2af2ec2b6447f376698d9f5b3d0852d4650ff1460f413b3c27d7b6125b6ad85d25243ec787cfe133654b3353093fdd4
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
43.229.206.212:443
82.209.17.209:8172
162.241.209.225:4125
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3964-115-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3196 3964 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe 3196 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3196 WerFault.exe Token: SeBackupPrivilege 3196 WerFault.exe Token: SeDebugPrivilege 3196 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3912 wrote to memory of 3964 3912 rundll32.exe rundll32.exe PID 3912 wrote to memory of 3964 3912 rundll32.exe rundll32.exe PID 3912 wrote to memory of 3964 3912 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9ebbe93fbdac80628a8e74c81b02993a491585d2e03f1e29bdc5eca935339a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9ebbe93fbdac80628a8e74c81b02993a491585d2e03f1e29bdc5eca935339a.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 7323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken