Analysis
-
max time kernel
19s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-06-2021 22:12
Static task
static1
General
-
Target
d4db7e9497d9893ecf9aa949b3a5e99796537fd7b062f8e69e8f78bea6580f59.dll
-
Size
162KB
-
MD5
e0fc79c4ec96efba60d5f7d2e588acc8
-
SHA1
6077f985b8c115f9fe839e80bcdf1159e30c2739
-
SHA256
d4db7e9497d9893ecf9aa949b3a5e99796537fd7b062f8e69e8f78bea6580f59
-
SHA512
57bb38471e204dc083a2c237adbbf5f03175000d9d77135e74ba2bb45ab70f15cb69f99be3a735382182077b0d0a35de420bf4fa74aabe05344902cefba7d6f6
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3996-115-0x0000000073A70000-0x0000000073A9E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1696 wrote to memory of 3996 1696 rundll32.exe rundll32.exe PID 1696 wrote to memory of 3996 1696 rundll32.exe rundll32.exe PID 1696 wrote to memory of 3996 1696 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4db7e9497d9893ecf9aa949b3a5e99796537fd7b062f8e69e8f78bea6580f59.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4db7e9497d9893ecf9aa949b3a5e99796537fd7b062f8e69e8f78bea6580f59.dll,#12⤵
- Checks whether UAC is enabled