Analysis
-
max time kernel
22s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/06/2021, 15:46
Static task
static1
General
-
Target
b69dee6c7fcb0fc00c9226ca495ce6126fb2017803fbd6167d59b0b6287d961c.dll
-
Size
172KB
-
MD5
231557636de47054b558c617b9732f90
-
SHA1
74ce7b5551a7a3e6b744faba412f2df7e559c295
-
SHA256
b69dee6c7fcb0fc00c9226ca495ce6126fb2017803fbd6167d59b0b6287d961c
-
SHA512
16e501227534e1d38c794c3b838692836c2f355c40c269c00366045e91401aeb1fb96c957f494077245c95ea16a17e8e017e09b7303c9398ebd7b8ec23b56b36
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
210.65.244.187:443
162.241.41.92:2303
46.231.204.10:8172
185.183.159.100:4125
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/3128-115-0x0000000073890000-0x00000000738C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1340 3128 WerFault.exe 70 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe 1340 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1340 WerFault.exe Token: SeBackupPrivilege 1340 WerFault.exe Token: SeDebugPrivilege 1340 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3128 2988 rundll32.exe 70 PID 2988 wrote to memory of 3128 2988 rundll32.exe 70 PID 2988 wrote to memory of 3128 2988 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b69dee6c7fcb0fc00c9226ca495ce6126fb2017803fbd6167d59b0b6287d961c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b69dee6c7fcb0fc00c9226ca495ce6126fb2017803fbd6167d59b0b6287d961c.dll,#12⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-