Analysis
-
max time kernel
18s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
29-06-2021 01:31
Static task
static1
General
-
Target
00db48983f74e224219b2fe48c8100146babbf13231b43675171c0f8c1762e0c.dll
-
Size
158KB
-
MD5
0da7dd12d9f283780b2c404ccef6aa0b
-
SHA1
911ee91ea41f09cea792607609a859f6ead199ae
-
SHA256
00db48983f74e224219b2fe48c8100146babbf13231b43675171c0f8c1762e0c
-
SHA512
d6e41c509a092cd5a87161c881837f1fd194503b0a851220e217153615a194b5b56e53424eb36ce05499f4cffb8391437aed7251a37e05b5d50069e2c2abd03a
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3924-115-0x0000000073F20000-0x0000000073F4D000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2256 wrote to memory of 3924 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 3924 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 3924 2256 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00db48983f74e224219b2fe48c8100146babbf13231b43675171c0f8c1762e0c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00db48983f74e224219b2fe48c8100146babbf13231b43675171c0f8c1762e0c.dll,#12⤵
- Checks whether UAC is enabled
PID:3924