Analysis
-
max time kernel
26s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 19:15
Static task
static1
General
-
Target
c740fad6bb19537f919ff7dca0c6be3f9294c80afd3a099c41f21114109f70ed.dll
-
Size
160KB
-
MD5
c46d25248a4f393aa74877073a379708
-
SHA1
18a7e5f55d0b393ac4aec79da9815ef52843fd82
-
SHA256
c740fad6bb19537f919ff7dca0c6be3f9294c80afd3a099c41f21114109f70ed
-
SHA512
49ce3ff76a2f312fe61b233c50ad70fc5556e5633659073037c11b663a01afeac7ffd0816febdb4c540ec0f11c77b95058d7b89c2c9222b9fd423b5673dced6b
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1552-115-0x0000000073F50000-0x0000000073F7E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 912 wrote to memory of 1552 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1552 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1552 912 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c740fad6bb19537f919ff7dca0c6be3f9294c80afd3a099c41f21114109f70ed.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c740fad6bb19537f919ff7dca0c6be3f9294c80afd3a099c41f21114109f70ed.dll,#12⤵
- Checks whether UAC is enabled