Analysis
-
max time kernel
25s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-06-2021 03:11
Static task
static1
General
-
Target
0d4b187ac597946a403f6870d9984b473566df4c29f9053ccf124dc3e05dc732.dll
-
Size
174KB
-
MD5
66306b1e141c06a53ba2b285c8153405
-
SHA1
4d85fcf2bbe9c2726acbe69335ec3c029725cfd1
-
SHA256
0d4b187ac597946a403f6870d9984b473566df4c29f9053ccf124dc3e05dc732
-
SHA512
99793258632d75d9b7999208353a72b6b921a2bc0fbc34f88e9e95432485faedbe2a6526b571f21633b175e22861c41a1596a684e2ecd694a21cc78c09aa8150
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.128.220.64:30333
45.79.91.89:9987
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1256-115-0x00000000735F0000-0x0000000073620000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2208 1256 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2208 WerFault.exe Token: SeBackupPrivilege 2208 WerFault.exe Token: SeDebugPrivilege 2208 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 660 wrote to memory of 1256 660 rundll32.exe rundll32.exe PID 660 wrote to memory of 1256 660 rundll32.exe rundll32.exe PID 660 wrote to memory of 1256 660 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4b187ac597946a403f6870d9984b473566df4c29f9053ccf124dc3e05dc732.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4b187ac597946a403f6870d9984b473566df4c29f9053ccf124dc3e05dc732.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 6443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken