Analysis
-
max time kernel
18s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-06-2021 11:20
Static task
static1
General
-
Target
563ac04ecdc7c8afa9f40866c4a4b2fe7e036ec8c132c4882edc99e6ceff48f7.dll
-
Size
158KB
-
MD5
7c35fd124a8f82572e25a2f874f25de7
-
SHA1
e832c4d2a0a9e63d5405ff9932c5cafd5646ea8f
-
SHA256
563ac04ecdc7c8afa9f40866c4a4b2fe7e036ec8c132c4882edc99e6ceff48f7
-
SHA512
64b3b1260070e2cbcebefeec213be9ba3a433204291776a101eaa262b7e4a60e1f7aab390e559b011da028997c98fa347c44ad1ff82d5b921d7556bbb7a9f009
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/964-115-0x0000000073AA0000-0x0000000073ACD000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2016 wrote to memory of 964 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 964 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 964 2016 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\563ac04ecdc7c8afa9f40866c4a4b2fe7e036ec8c132c4882edc99e6ceff48f7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\563ac04ecdc7c8afa9f40866c4a4b2fe7e036ec8c132c4882edc99e6ceff48f7.dll,#12⤵
- Checks whether UAC is enabled
PID:964