Analysis
-
max time kernel
27s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/06/2021, 15:24
Static task
static1
General
-
Target
6a3099d5f842884d995f44bd53ab77b85304e4b316fe54f573d281617ad28d95.dll
-
Size
170KB
-
MD5
fcbcc59ca53ef963c01f6c65ecb908b7
-
SHA1
2d28c7a7171a44030c4e644223b54e9b39b02f41
-
SHA256
6a3099d5f842884d995f44bd53ab77b85304e4b316fe54f573d281617ad28d95
-
SHA512
e7095e81c0f0aa13bed798fa5b7302bf9b717bc61d6b1a919c128ea8168f9bd8f0e87b9c0c2c4212b98efe5f801e0721b0ab693fcbd652e23e9f7c623b645aec
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2156-115-0x0000000073890000-0x00000000738C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1528 2156 WerFault.exe 70 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe 1528 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1528 WerFault.exe Token: SeBackupPrivilege 1528 WerFault.exe Token: SeDebugPrivilege 1528 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2156 2988 rundll32.exe 70 PID 2988 wrote to memory of 2156 2988 rundll32.exe 70 PID 2988 wrote to memory of 2156 2988 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a3099d5f842884d995f44bd53ab77b85304e4b316fe54f573d281617ad28d95.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a3099d5f842884d995f44bd53ab77b85304e4b316fe54f573d281617ad28d95.dll,#12⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 6843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-