Analysis
-
max time kernel
28s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-06-2021 07:59
Static task
static1
General
-
Target
3cb62e962a48a226102d1572139f5a6dc9734313f7fb9186172117fc86b2a1a7.dll
-
Size
160KB
-
MD5
e2e5d605971ecd634b8403042e177c92
-
SHA1
ef51c26eda44d9592e03fcbf39952e2322f44752
-
SHA256
3cb62e962a48a226102d1572139f5a6dc9734313f7fb9186172117fc86b2a1a7
-
SHA512
8dcbce8d78d072ff3c32086be52084d6e8604389e05a26bce295ea0b696670c42c82ccd7e4cb0e5a5f1e6a3dbd1daf5700ef09d45f8aa3d4b6b34095d9d47a74
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3560-115-0x0000000073990000-0x00000000739BE000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4060 wrote to memory of 3560 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 3560 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 3560 4060 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb62e962a48a226102d1572139f5a6dc9734313f7fb9186172117fc86b2a1a7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb62e962a48a226102d1572139f5a6dc9734313f7fb9186172117fc86b2a1a7.dll,#12⤵
- Checks whether UAC is enabled