Analysis
-
max time kernel
26s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-06-2021 03:36
Static task
static1
General
-
Target
d02217b94526882baefa009755bc9198d94a437ec9c8a54175a8e6342bc594b5.dll
-
Size
174KB
-
MD5
7a1dc01647eb8fe259c4fd1682a9a2df
-
SHA1
3230d183718645fb30cfac2500fd087f8a322ed0
-
SHA256
d02217b94526882baefa009755bc9198d94a437ec9c8a54175a8e6342bc594b5
-
SHA512
ff8ffaebaa8649b1806362ebf0a828c8616e239a1e4e35b0bb9033d2f5e7a81f1328a009738bc99452eb5fbe50b397d1e2a4f701cfb06ad9c52a782b899b583c
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.128.220.64:30333
45.79.91.89:9987
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1792-115-0x0000000074160000-0x0000000074190000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3692 1792 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe 3692 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3692 WerFault.exe Token: SeBackupPrivilege 3692 WerFault.exe Token: SeDebugPrivilege 3692 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 996 wrote to memory of 1792 996 rundll32.exe rundll32.exe PID 996 wrote to memory of 1792 996 rundll32.exe rundll32.exe PID 996 wrote to memory of 1792 996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d02217b94526882baefa009755bc9198d94a437ec9c8a54175a8e6342bc594b5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d02217b94526882baefa009755bc9198d94a437ec9c8a54175a8e6342bc594b5.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 6443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken