Analysis
-
max time kernel
18s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-06-2021 23:57
Static task
static1
General
-
Target
05c5d4e27a024cda57b42faeead0ac198ccf480b95e85a82367cba0d020dfd14.dll
-
Size
160KB
-
MD5
b132560a11ced2cbd8dd1ef95c95d1c6
-
SHA1
2281dec7c4f8019fcf21739bf6a66785f785cce6
-
SHA256
05c5d4e27a024cda57b42faeead0ac198ccf480b95e85a82367cba0d020dfd14
-
SHA512
f3ee45f85d07072ba0cccdf286baeb12f63dc8dceca572a5859b15dc737b86f4d5f6c69d588fe4c2afcb12bae8453603b45ccd43428eed255dcf715d1c5c7566
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1704-115-0x0000000073EE0000-0x0000000073F0E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3224 wrote to memory of 1704 3224 rundll32.exe rundll32.exe PID 3224 wrote to memory of 1704 3224 rundll32.exe rundll32.exe PID 3224 wrote to memory of 1704 3224 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05c5d4e27a024cda57b42faeead0ac198ccf480b95e85a82367cba0d020dfd14.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05c5d4e27a024cda57b42faeead0ac198ccf480b95e85a82367cba0d020dfd14.dll,#12⤵
- Checks whether UAC is enabled