Analysis
-
max time kernel
19s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25-06-2021 04:42
Static task
static1
General
-
Target
cf802cb3c85e9bdffb240ffe6dda4417e1c356c62ebe8dcee0b0bba9f081fa72.dll
-
Size
158KB
-
MD5
309cee4af7f9cf61e8454595710f374c
-
SHA1
d1ea590265595120a59a2032d88ad944ec3957b3
-
SHA256
cf802cb3c85e9bdffb240ffe6dda4417e1c356c62ebe8dcee0b0bba9f081fa72
-
SHA512
2f7b5cd976a3629d1fe2a39b52ec66715a588abcf3914dac13b54da358a53dca8dd4de2d0936d2626e3e4c1bb66405078ef0c222f656979dab5bf61966f2b0b8
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1968-115-0x0000000073660000-0x000000007368D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4092 wrote to memory of 1968 4092 rundll32.exe rundll32.exe PID 4092 wrote to memory of 1968 4092 rundll32.exe rundll32.exe PID 4092 wrote to memory of 1968 4092 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf802cb3c85e9bdffb240ffe6dda4417e1c356c62ebe8dcee0b0bba9f081fa72.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf802cb3c85e9bdffb240ffe6dda4417e1c356c62ebe8dcee0b0bba9f081fa72.dll,#12⤵
- Checks whether UAC is enabled
PID:1968