Analysis
-
max time kernel
241s -
max time network
280s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 17:05
Static task
static1
Behavioral task
behavioral1
Sample
0_WPDSp.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0_WPDSp.dll
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
4_aepdu.dll
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
4_aepdu.dll
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
8_hp8500at.dll
Resource
win7-en-20211014
General
-
Target
0_WPDSp.dll
-
Size
180KB
-
MD5
8bbac1f6e64537bd91f903994912dc96
-
SHA1
9099279d268d3b3ded00bcc5294b8df79b7a6abe
-
SHA256
12627600a70bff6a42e8319f71a2221338ff54332afbf6ae28f130f2cfde630b
-
SHA512
4684a015de4a1bc2852000624adbd3243db72d3d544636c1713a475a71bc407707a8a6509fa956b5dc5bd071ca7e09ee33f4cde48baf62ff5d0ecb2725fb4b8f
Malware Config
Extracted
dridex
22201
212.237.17.99:443
176.28.17.160:6602
51.254.140.238:8333
Signatures
-
Processes:
resource yara_rule behavioral1/memory/472-56-0x0000000074950000-0x000000007497F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 472 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1324 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 472 524 rundll32.exe rundll32.exe PID 472 wrote to memory of 1324 472 rundll32.exe WerFault.exe PID 472 wrote to memory of 1324 472 rundll32.exe WerFault.exe PID 472 wrote to memory of 1324 472 rundll32.exe WerFault.exe PID 472 wrote to memory of 1324 472 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0_WPDSp.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0_WPDSp.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 2523⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-54-0x0000000000000000-mapping.dmp
-
memory/472-55-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/472-56-0x0000000074950000-0x000000007497F000-memory.dmpFilesize
188KB
-
memory/472-59-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/1324-58-0x0000000000000000-mapping.dmp
-
memory/1324-60-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB