Analysis
-
max time kernel
131s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-07-2021 19:33
Static task
static1
Behavioral task
behavioral1
Sample
8b16733dcb7b1477a70352b8b37893d8.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
8b16733dcb7b1477a70352b8b37893d8.dll
-
Size
175KB
-
MD5
8b16733dcb7b1477a70352b8b37893d8
-
SHA1
0a7752872504ed87a1598f78633f940315acb558
-
SHA256
6e1a19c1ead7999ac95c9a6ec469cedfdda7b513dee65cf6c3c7ebf9385eaffc
-
SHA512
4abf4d4e3fc216bfeea33b400954a15a4d3c9cb913ef9bd032ddcc11be30b80650a4999309fd16bfc499101f13140365c0b2f438d9c719fc858022cc1bce7725
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1808-61-0x00000000749E0000-0x0000000074A10000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 616 1808 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 616 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 616 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 292 wrote to memory of 1808 292 rundll32.exe rundll32.exe PID 1808 wrote to memory of 616 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 616 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 616 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 616 1808 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b16733dcb7b1477a70352b8b37893d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b16733dcb7b1477a70352b8b37893d8.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:616
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/616-63-0x0000000000000000-mapping.dmp
-
memory/616-65-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1808-59-0x0000000000000000-mapping.dmp
-
memory/1808-60-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/1808-61-0x00000000749E0000-0x0000000074A10000-memory.dmpFilesize
192KB
-
memory/1808-64-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB