Analysis
-
max time kernel
19s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-06-2021 22:36
Static task
static1
General
-
Target
a4d8857621aeecb3410604552f04dbc777f4691eae5161c584b503ecca5b4c82.dll
-
Size
158KB
-
MD5
e077359efafebebaf229ed790c8e3783
-
SHA1
c93d6ef5cf9fce040754323dc8bf4edc9ec3a074
-
SHA256
a4d8857621aeecb3410604552f04dbc777f4691eae5161c584b503ecca5b4c82
-
SHA512
0106ecc8c5a509f7ae0dcb521ac3476da4033ce6bdfdf74a6f50cf34a2cbc23609eb204b32d33d5330e2db643308b5992d656e31fb258018950ae2a8c2243bef
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3952-115-0x0000000074380000-0x00000000743AD000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3904 wrote to memory of 3952 3904 rundll32.exe rundll32.exe PID 3904 wrote to memory of 3952 3904 rundll32.exe rundll32.exe PID 3904 wrote to memory of 3952 3904 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4d8857621aeecb3410604552f04dbc777f4691eae5161c584b503ecca5b4c82.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4d8857621aeecb3410604552f04dbc777f4691eae5161c584b503ecca5b4c82.dll,#12⤵
- Checks whether UAC is enabled