Analysis
-
max time kernel
18s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-06-2021 02:10
Static task
static1
General
-
Target
c4ef907b7e5ae2c2a086167a707a46935b3f791892c718e6f9f3a174ef841225.dll
-
Size
170KB
-
MD5
aad33cd4aae4df40908a2f60eec10d89
-
SHA1
c418d5d857fe412240687f82b44527ecdf9b90b4
-
SHA256
c4ef907b7e5ae2c2a086167a707a46935b3f791892c718e6f9f3a174ef841225
-
SHA512
e4da07465caf5f4e0075af1bb868630e43b62f2931e23a6ac21b7f8bf764c693ca90e4e27308ef76e059601efe87522e3eaf515efd01db1808ce9c772faf377c
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/4080-115-0x00000000755E0000-0x0000000075610000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1968 4080 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe 1968 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1968 WerFault.exe Token: SeBackupPrivilege 1968 WerFault.exe Token: SeDebugPrivilege 1968 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4048 wrote to memory of 4080 4048 rundll32.exe rundll32.exe PID 4048 wrote to memory of 4080 4048 rundll32.exe rundll32.exe PID 4048 wrote to memory of 4080 4048 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ef907b7e5ae2c2a086167a707a46935b3f791892c718e6f9f3a174ef841225.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ef907b7e5ae2c2a086167a707a46935b3f791892c718e6f9f3a174ef841225.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken