Analysis
-
max time kernel
25s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-06-2021 23:01
Static task
static1
General
-
Target
596995bf4614d6cf47960d9122c2db26f66f5f3f348b935e7a0088d2ff0e6868.dll
-
Size
160KB
-
MD5
75ecd866e8d6fc1e0951cf7f129c69eb
-
SHA1
4760e1051d441f2b696f974bc35b0189e3eb9028
-
SHA256
596995bf4614d6cf47960d9122c2db26f66f5f3f348b935e7a0088d2ff0e6868
-
SHA512
8d310bb439ea9413e7984287298ddae1ce720e18946b4e270d9802e50d1162666c55f8679d2bc725d4f06a0e2420396632e808ec05c4f04fef9f69c1b650ef3b
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/4000-115-0x0000000073560000-0x000000007358E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3492 wrote to memory of 4000 3492 rundll32.exe rundll32.exe PID 3492 wrote to memory of 4000 3492 rundll32.exe rundll32.exe PID 3492 wrote to memory of 4000 3492 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\596995bf4614d6cf47960d9122c2db26f66f5f3f348b935e7a0088d2ff0e6868.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\596995bf4614d6cf47960d9122c2db26f66f5f3f348b935e7a0088d2ff0e6868.dll,#12⤵
- Checks whether UAC is enabled