Analysis
-
max time kernel
18s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-06-2021 11:28
Static task
static1
General
-
Target
9efa2be3b8cdeb0b0d3291b7a73183cf65ac95f751fb1e58ea5b2396d26e63ad.dll
-
Size
158KB
-
MD5
4bf5f39c639cd1c92b681f1859d16344
-
SHA1
05d79c67440ad67bfbbd3de945d416d9fea48cc9
-
SHA256
9efa2be3b8cdeb0b0d3291b7a73183cf65ac95f751fb1e58ea5b2396d26e63ad
-
SHA512
7c539e5d08a46bb98b2ca95eba4c4d64d88d8062176d5837a02d097617bca5af05eab4df4d00a054c4ac46a1aee15a214e098d36a19692b590e4897e00d2c2df
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/772-115-0x0000000073BF0000-0x0000000073C1D000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 772 3176 rundll32.exe 63 PID 3176 wrote to memory of 772 3176 rundll32.exe 63 PID 3176 wrote to memory of 772 3176 rundll32.exe 63
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9efa2be3b8cdeb0b0d3291b7a73183cf65ac95f751fb1e58ea5b2396d26e63ad.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9efa2be3b8cdeb0b0d3291b7a73183cf65ac95f751fb1e58ea5b2396d26e63ad.dll,#12⤵
- Checks whether UAC is enabled
PID:772
-