Analysis
-
max time kernel
25s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/06/2021, 15:21
Static task
static1
General
-
Target
417962beb3c20117a417c58c2f2840fb89e52784b39cc64be43aae56c301c603.dll
-
Size
172KB
-
MD5
dc085f30d8ce8abe5a597bbf185ace8c
-
SHA1
679b6570847702331f3444f9ad93bc2e0361a6ed
-
SHA256
417962beb3c20117a417c58c2f2840fb89e52784b39cc64be43aae56c301c603
-
SHA512
4d0e97cdbefabc2c8c749f238ae4ab8fc619bd5bc7e76eabd33fca7d3529e99af62eff3b1e12e902380011bcb8a2d43d7a9566cc7c2b2dbe5449ec56d972185c
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
210.65.244.187:443
162.241.41.92:2303
46.231.204.10:8172
185.183.159.100:4125
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/3128-115-0x0000000073890000-0x00000000738C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 3576 3128 WerFault.exe 71 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3576 WerFault.exe Token: SeBackupPrivilege 3576 WerFault.exe Token: SeDebugPrivilege 3576 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3128 2988 rundll32.exe 71 PID 2988 wrote to memory of 3128 2988 rundll32.exe 71 PID 2988 wrote to memory of 3128 2988 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\417962beb3c20117a417c58c2f2840fb89e52784b39cc64be43aae56c301c603.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\417962beb3c20117a417c58c2f2840fb89e52784b39cc64be43aae56c301c603.dll,#12⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-