Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
88453945ce19bdad841603e1b449ad30.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
88453945ce19bdad841603e1b449ad30.dll
-
Size
176KB
-
MD5
88453945ce19bdad841603e1b449ad30
-
SHA1
9bd3279c75d75294f56511bb890112b8266412f1
-
SHA256
bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad
-
SHA512
f47d27965ab9cfb42c432397958a69e4076c597996ba5008417212658071daa4f26ad10330807f6e34a3b2a5ef599e0a8b9acbde8c4ec43c74e4e92643c1356f
Malware Config
Extracted
Family
dridex
Botnet
22202
C2
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2020-61-0x0000000074510000-0x0000000074541000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1600 2020 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1600 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1600 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 2020 1240 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1600 2020 rundll32.exe WerFault.exe PID 2020 wrote to memory of 1600 2020 rundll32.exe WerFault.exe PID 2020 wrote to memory of 1600 2020 rundll32.exe WerFault.exe PID 2020 wrote to memory of 1600 2020 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 2243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1600-63-0x0000000000000000-mapping.dmp
-
memory/1600-65-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2020-59-0x0000000000000000-mapping.dmp
-
memory/2020-60-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/2020-61-0x0000000074510000-0x0000000074541000-memory.dmpFilesize
196KB
-
memory/2020-64-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB