Analysis
-
max time kernel
18s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25-06-2021 06:52
Static task
static1
General
-
Target
075124e9d420b378c0e023b8babaac5be4d03a129ed09784ecb9cbbf514fc102.dll
-
Size
160KB
-
MD5
c773bdb0c075b0dae45430cb3b08c8e7
-
SHA1
50456864dcf8ad30749d6c2805f4a454b5e5f0bd
-
SHA256
075124e9d420b378c0e023b8babaac5be4d03a129ed09784ecb9cbbf514fc102
-
SHA512
148a625e1427b9d05b21a3df5bf1cc5e95eadee3ce98974299f130cf8af9e1a6ba1af091a828f05a41072ea80359b82c50381ca6eeb1a31b56b1abeacab77024
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1676-115-0x0000000073BF0000-0x0000000073C1E000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3164 wrote to memory of 1676 3164 rundll32.exe rundll32.exe PID 3164 wrote to memory of 1676 3164 rundll32.exe rundll32.exe PID 3164 wrote to memory of 1676 3164 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\075124e9d420b378c0e023b8babaac5be4d03a129ed09784ecb9cbbf514fc102.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\075124e9d420b378c0e023b8babaac5be4d03a129ed09784ecb9cbbf514fc102.dll,#12⤵
- Checks whether UAC is enabled
PID:1676