Analysis
-
max time kernel
25s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/06/2021, 15:32
Static task
static1
General
-
Target
dd69d63712b19a192d02e81875d3234a650dc9b810f0d15d33f811c83363358e.dll
-
Size
172KB
-
MD5
685ad4c2bd32d3c183fc42ba2d23bff1
-
SHA1
8537c6abee66cf624af0862b0236c8b7db9a64cc
-
SHA256
dd69d63712b19a192d02e81875d3234a650dc9b810f0d15d33f811c83363358e
-
SHA512
eb63e21bccb0226282dd703386220ea45604acb0f98a77218ed0578b4d229773f3a4d6416496bf8f381ebd16304ac92c4c997e5e0de583d37134ae185d420392
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
210.65.244.187:443
162.241.41.92:2303
46.231.204.10:8172
185.183.159.100:4125
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/780-115-0x0000000073890000-0x00000000738C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1528 780 WerFault.exe 69 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1528 WerFault.exe Token: SeBackupPrivilege 1528 WerFault.exe Token: SeDebugPrivilege 1528 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2996 wrote to memory of 780 2996 rundll32.exe 69 PID 2996 wrote to memory of 780 2996 rundll32.exe 69 PID 2996 wrote to memory of 780 2996 rundll32.exe 69
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd69d63712b19a192d02e81875d3234a650dc9b810f0d15d33f811c83363358e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd69d63712b19a192d02e81875d3234a650dc9b810f0d15d33f811c83363358e.dll,#12⤵PID:780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-