Analysis
-
max time kernel
18s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-06-2021 04:21
Static task
static1
General
-
Target
c76a1c84b98839ebf92a92fb7f5c620e9964046d00f570292babd0550917d694.dll
-
Size
158KB
-
MD5
1c06e353eec958b94ea730c78b87dbb2
-
SHA1
fec8388b3611666712078ab3a9743ae50c6446a7
-
SHA256
c76a1c84b98839ebf92a92fb7f5c620e9964046d00f570292babd0550917d694
-
SHA512
a242bc934671d4cf9b749ac545199d737433feca6d929080778e211c629f1f31a13a69859752cce9b6c7993119643510efe6b8646146840a2afbcb428e39da70
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/720-115-0x0000000074300000-0x000000007432D000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 500 wrote to memory of 720 500 rundll32.exe 72 PID 500 wrote to memory of 720 500 rundll32.exe 72 PID 500 wrote to memory of 720 500 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c76a1c84b98839ebf92a92fb7f5c620e9964046d00f570292babd0550917d694.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c76a1c84b98839ebf92a92fb7f5c620e9964046d00f570292babd0550917d694.dll,#12⤵
- Checks whether UAC is enabled
PID:720
-