Analysis
-
max time kernel
25s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-07-2021 20:01
Static task
static1
Behavioral task
behavioral1
Sample
88453945ce19bdad841603e1b449ad30.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
88453945ce19bdad841603e1b449ad30.dll
-
Size
176KB
-
MD5
88453945ce19bdad841603e1b449ad30
-
SHA1
9bd3279c75d75294f56511bb890112b8266412f1
-
SHA256
bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad
-
SHA512
f47d27965ab9cfb42c432397958a69e4076c597996ba5008417212658071daa4f26ad10330807f6e34a3b2a5ef599e0a8b9acbde8c4ec43c74e4e92643c1356f
Malware Config
Extracted
Family
dridex
Botnet
22202
C2
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3652-115-0x00000000743F0000-0x0000000074421000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4092 3652 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4092 WerFault.exe Token: SeBackupPrivilege 4092 WerFault.exe Token: SeDebugPrivilege 4092 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1832 wrote to memory of 3652 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 3652 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 3652 1832 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 6363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken