Analysis
-
max time kernel
19s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-06-2021 06:23
Static task
static1
General
-
Target
4570b324fa6d286fbb5b62170c128372bd70c7c56e5ea5ef64cc91256ff7b595.dll
-
Size
158KB
-
MD5
fe85a40827f310037908d900ab4a3e19
-
SHA1
d822ad35a9c07bcc253f177982c6c40211f505dd
-
SHA256
4570b324fa6d286fbb5b62170c128372bd70c7c56e5ea5ef64cc91256ff7b595
-
SHA512
d2c6d0c59ce8aa9b8c5207fdfdc4f57fa8386dc89629a2620d275a5692835c2d10e1f4d9b705a61131fbaaad3e53acac89dafaa73153ef56a08a52364de32096
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2292-115-0x0000000074380000-0x00000000743AD000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3904 wrote to memory of 2292 3904 rundll32.exe 70 PID 3904 wrote to memory of 2292 3904 rundll32.exe 70 PID 3904 wrote to memory of 2292 3904 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4570b324fa6d286fbb5b62170c128372bd70c7c56e5ea5ef64cc91256ff7b595.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4570b324fa6d286fbb5b62170c128372bd70c7c56e5ea5ef64cc91256ff7b595.dll,#12⤵
- Checks whether UAC is enabled
PID:2292
-