Analysis
-
max time kernel
17s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-06-2021 03:14
Static task
static1
General
-
Target
f8538bbe3f8665ce80f18155bef9c3f149c87ec5d79defded350f588f7ab0856.dll
-
Size
170KB
-
MD5
ec02eb20b2f721cb1530df631566640c
-
SHA1
8a98b8fc18e2395b7b8e11a1b5002b0405d17d45
-
SHA256
f8538bbe3f8665ce80f18155bef9c3f149c87ec5d79defded350f588f7ab0856
-
SHA512
4335d2509986c7cb329a2d4a6d1a913ab751cb0bf9dd782edae61974782e6310a6d5e3e9343aef0253198b70568a9e597a88e5b5fa8be6b8a1ec161f1673287c
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/60-115-0x0000000073A90000-0x0000000073AC0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3288 60 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe 3288 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3288 WerFault.exe Token: SeBackupPrivilege 3288 WerFault.exe Token: SeDebugPrivilege 3288 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3380 wrote to memory of 60 3380 rundll32.exe rundll32.exe PID 3380 wrote to memory of 60 3380 rundll32.exe rundll32.exe PID 3380 wrote to memory of 60 3380 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8538bbe3f8665ce80f18155bef9c3f149c87ec5d79defded350f588f7ab0856.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8538bbe3f8665ce80f18155bef9c3f149c87ec5d79defded350f588f7ab0856.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken