Analysis
-
max time kernel
17s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-06-2021 00:48
Static task
static1
General
-
Target
74aeee6e493a89d6ac29b4424d25b7c89615c48afb20c6987aeee6fb91afacba.dll
-
Size
174KB
-
MD5
f86b892dbd94d77c5fd4223792a85e15
-
SHA1
05839e3523065bd97d036ac74f1845bfcf82f140
-
SHA256
74aeee6e493a89d6ac29b4424d25b7c89615c48afb20c6987aeee6fb91afacba
-
SHA512
43be1afaed133cf3b81bf786a9e329d540514d9e905ed6b94c421661b4d9c2f68fef47ffb398b562f24ba7d2a3b7d1bcff461830ca534be4aea04f81f7696688
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.128.220.64:30333
45.79.91.89:9987
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2100-115-0x0000000073B80000-0x0000000073BB0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1336 2100 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe 1336 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1336 WerFault.exe Token: SeBackupPrivilege 1336 WerFault.exe Token: SeDebugPrivilege 1336 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3984 wrote to memory of 2100 3984 rundll32.exe rundll32.exe PID 3984 wrote to memory of 2100 3984 rundll32.exe rundll32.exe PID 3984 wrote to memory of 2100 3984 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74aeee6e493a89d6ac29b4424d25b7c89615c48afb20c6987aeee6fb91afacba.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74aeee6e493a89d6ac29b4424d25b7c89615c48afb20c6987aeee6fb91afacba.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 6443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken