Analysis
-
max time kernel
24s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-07-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
88453945ce19bdad841603e1b449ad30.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
88453945ce19bdad841603e1b449ad30.dll
-
Size
176KB
-
MD5
88453945ce19bdad841603e1b449ad30
-
SHA1
9bd3279c75d75294f56511bb890112b8266412f1
-
SHA256
bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad
-
SHA512
f47d27965ab9cfb42c432397958a69e4076c597996ba5008417212658071daa4f26ad10330807f6e34a3b2a5ef599e0a8b9acbde8c4ec43c74e4e92643c1356f
Malware Config
Extracted
Family
dridex
Botnet
22202
C2
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1424-115-0x00000000736C0000-0x00000000736F1000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1820 1424 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe 1820 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1820 WerFault.exe Token: SeBackupPrivilege 1820 WerFault.exe Token: SeDebugPrivilege 1820 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 664 wrote to memory of 1424 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 1424 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 1424 664 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\88453945ce19bdad841603e1b449ad30.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 6403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken