Analysis
-
max time kernel
25s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-06-2021 03:21
Static task
static1
General
-
Target
e65de1b1e051537f9e9e27f494bef181b68d8cb8a332c1d8ce58f282304d3e7e.dll
-
Size
174KB
-
MD5
c5da98fe61e6e761bab6fa4bac264ced
-
SHA1
e1bafe69f9659bc140d65d52937a46ccfbc13bf3
-
SHA256
e65de1b1e051537f9e9e27f494bef181b68d8cb8a332c1d8ce58f282304d3e7e
-
SHA512
374a4811df43e99716dbe646a17cfceba1698064803edbd29850adfc57f19d23ccf26bf2651a5ac921a5baf8bda275fbd27782c2e944c9d7549a8d7efff32f22
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.128.220.64:30333
45.79.91.89:9987
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1760-115-0x0000000073C70000-0x0000000073CA0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 512 1760 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 512 WerFault.exe Token: SeBackupPrivilege 512 WerFault.exe Token: SeDebugPrivilege 512 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 708 wrote to memory of 1760 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 1760 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 1760 708 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e65de1b1e051537f9e9e27f494bef181b68d8cb8a332c1d8ce58f282304d3e7e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e65de1b1e051537f9e9e27f494bef181b68d8cb8a332c1d8ce58f282304d3e7e.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 6563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken