Analysis
-
max time kernel
27s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-06-2021 14:33
Static task
static1
General
-
Target
e4d4ed1e06e90f99c3a325503996241cee796a93ba5b3b6da800531ac4b20fa9.dll
-
Size
158KB
-
MD5
5093393a41a9a90ce8540633459ecf07
-
SHA1
c808849868a2ba07d3ef195fc3d00b41c2bafb16
-
SHA256
e4d4ed1e06e90f99c3a325503996241cee796a93ba5b3b6da800531ac4b20fa9
-
SHA512
5580590028571b758514b5b6259bd0d709a9df1b54fd3b2a94c55147ebde99f7bcd3e051d0f885466807dee67ae615c9baf5a738eb77fb5e59045beaccd3a3ff
Malware Config
Extracted
Family
dridex
Botnet
40111
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/392-115-0x0000000074350000-0x000000007437D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 652 wrote to memory of 392 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 392 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 392 652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d4ed1e06e90f99c3a325503996241cee796a93ba5b3b6da800531ac4b20fa9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4d4ed1e06e90f99c3a325503996241cee796a93ba5b3b6da800531ac4b20fa9.dll,#12⤵
- Checks whether UAC is enabled