Analysis
-
max time kernel
26s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-06-2021 00:14
Static task
static1
General
-
Target
95a6f184a69ceedc75457a600c72845f988a2918d5b7177faea77858af0383c4.dll
-
Size
174KB
-
MD5
6a90a2c37307de7d8ad761b6b7ab8c47
-
SHA1
eb058b7afe4c1e6de966f375f701991c8d272f61
-
SHA256
95a6f184a69ceedc75457a600c72845f988a2918d5b7177faea77858af0383c4
-
SHA512
a875abcd73fb520b0787587d5c9c462f8ac0525fa09ace4d5c8807c47d4fdf34e157c3d935645939c65af995039c165d484f47e1ed871cc90f8d5018cc7365b7
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.128.220.64:30333
45.79.91.89:9987
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2540-115-0x0000000073990000-0x00000000739C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 844 2540 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe 844 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 844 WerFault.exe Token: SeBackupPrivilege 844 WerFault.exe Token: SeDebugPrivilege 844 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1440 wrote to memory of 2540 1440 rundll32.exe rundll32.exe PID 1440 wrote to memory of 2540 1440 rundll32.exe rundll32.exe PID 1440 wrote to memory of 2540 1440 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95a6f184a69ceedc75457a600c72845f988a2918d5b7177faea77858af0383c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95a6f184a69ceedc75457a600c72845f988a2918d5b7177faea77858af0383c4.dll,#12⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 6523⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844