Analysis
-
max time kernel
25s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 05:23
Static task
static1
General
-
Target
05b7e69b80248a5bea47b7e88b27d925f475403982e0696800e6fb9f95fab165.dll
-
Size
160KB
-
MD5
0c78a2a56ac6cc4d63487efbb94e98e7
-
SHA1
b7512807bc9266a78e5370acdea80062b1238e08
-
SHA256
05b7e69b80248a5bea47b7e88b27d925f475403982e0696800e6fb9f95fab165
-
SHA512
36bb7ef866a66e2879ab8affd2825268ba38834f69d8d16073c8ffcbce7f79a003612f3e0897f8a2ed7654c9be77f83c35dce6453eee04505b8a8f30a018ca2f
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1116-115-0x0000000074310000-0x000000007433E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 644 wrote to memory of 1116 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 1116 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 1116 644 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05b7e69b80248a5bea47b7e88b27d925f475403982e0696800e6fb9f95fab165.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05b7e69b80248a5bea47b7e88b27d925f475403982e0696800e6fb9f95fab165.dll,#12⤵
- Checks whether UAC is enabled