Analysis
-
max time kernel
23s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/06/2021, 15:32
Static task
static1
General
-
Target
06713f076507fa303de6391213293ff0a743f3bfdc189e5574b31d07921b798c.dll
-
Size
170KB
-
MD5
ff705ef4901f641828fda9a76c568b70
-
SHA1
78ee7279ff59da2debca902b8d08c8077914ef3d
-
SHA256
06713f076507fa303de6391213293ff0a743f3bfdc189e5574b31d07921b798c
-
SHA512
2974f974b4f59963b1717fe099631613d0a82f022486d679569738e51750e4a8e2f7fd5c2421872f76d89b2f8dc07b38f6d36145f3c2b3921f822b2275e5aa2e
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/820-115-0x0000000074400000-0x0000000074430000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2584 820 WerFault.exe 68 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe 2584 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2584 WerFault.exe Token: SeBackupPrivilege 2584 WerFault.exe Token: SeDebugPrivilege 2584 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 744 wrote to memory of 820 744 rundll32.exe 68 PID 744 wrote to memory of 820 744 rundll32.exe 68 PID 744 wrote to memory of 820 744 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06713f076507fa303de6391213293ff0a743f3bfdc189e5574b31d07921b798c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06713f076507fa303de6391213293ff0a743f3bfdc189e5574b31d07921b798c.dll,#12⤵PID:820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-