Analysis
-
max time kernel
27s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-06-2021 12:29
Static task
static1
General
-
Target
8b6d0a8e16bb32da86416e791fc4e2b6715c9451a0b5720c5373ff6f9b6da0f4.dll
-
Size
158KB
-
MD5
299a54fa95e7dd98a4e50c6182cccea1
-
SHA1
cb2cff4d7f0c5200ae94b35bc1409f9267975f3f
-
SHA256
8b6d0a8e16bb32da86416e791fc4e2b6715c9451a0b5720c5373ff6f9b6da0f4
-
SHA512
1050cbed11ea591784d89fed96b5f7a6afd695434e54b345feef345ff3eae7cea5568ea36db2fb292cba6d9bee3f3016bfaf4c314cc25cdbc1dd9ef8dffe8428
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/1120-115-0x0000000073C70000-0x0000000073C9D000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 708 wrote to memory of 1120 708 rundll32.exe 68 PID 708 wrote to memory of 1120 708 rundll32.exe 68 PID 708 wrote to memory of 1120 708 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6d0a8e16bb32da86416e791fc4e2b6715c9451a0b5720c5373ff6f9b6da0f4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6d0a8e16bb32da86416e791fc4e2b6715c9451a0b5720c5373ff6f9b6da0f4.dll,#12⤵
- Checks whether UAC is enabled
PID:1120
-