Analysis
-
max time kernel
17s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-06-2021 01:09
Static task
static1
General
-
Target
3a1391480968f59134ac7f3001364547655b06d197efede4d67125efef345e2b.dll
-
Size
163KB
-
MD5
8808c4d9e2e9a45db743e0a41d68fb50
-
SHA1
8b20649a4232e649d0c8ffe4bc87d3446fa9fdd2
-
SHA256
3a1391480968f59134ac7f3001364547655b06d197efede4d67125efef345e2b
-
SHA512
a9f2a1cad609cd64a207f356c294cfed15870ac9c03fc9a36a7633d0c64d95877bb0e32bf54be4eced798a1b20120477f3cd2ca855cd95d5d19b80659fc1efb9
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
43.229.206.212:443
82.209.17.209:8172
162.241.209.225:4125
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/4024-115-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3800 4024 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe 3800 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3800 WerFault.exe Token: SeBackupPrivilege 3800 WerFault.exe Token: SeDebugPrivilege 3800 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4064 wrote to memory of 4024 4064 rundll32.exe rundll32.exe PID 4064 wrote to memory of 4024 4064 rundll32.exe rundll32.exe PID 4064 wrote to memory of 4024 4064 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1391480968f59134ac7f3001364547655b06d197efede4d67125efef345e2b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1391480968f59134ac7f3001364547655b06d197efede4d67125efef345e2b.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 7243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken