Analysis
-
max time kernel
300s -
max time network
304s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 17:05
Static task
static1
Behavioral task
behavioral1
Sample
0_WPDSp.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0_WPDSp.dll
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
4_aepdu.dll
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
4_aepdu.dll
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
8_hp8500at.dll
Resource
win7-en-20211014
General
-
Target
0_WPDSp.dll
-
Size
180KB
-
MD5
8bbac1f6e64537bd91f903994912dc96
-
SHA1
9099279d268d3b3ded00bcc5294b8df79b7a6abe
-
SHA256
12627600a70bff6a42e8319f71a2221338ff54332afbf6ae28f130f2cfde630b
-
SHA512
4684a015de4a1bc2852000624adbd3243db72d3d544636c1713a475a71bc407707a8a6509fa956b5dc5bd071ca7e09ee33f4cde48baf62ff5d0ecb2725fb4b8f
Malware Config
Extracted
dridex
22201
212.237.17.99:443
176.28.17.160:6602
51.254.140.238:8333
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4192-116-0x0000000073DB0000-0x0000000073DDF000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4016 4192 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4016 WerFault.exe Token: SeBackupPrivilege 4016 WerFault.exe Token: SeDebugPrivilege 4016 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4188 wrote to memory of 4192 4188 rundll32.exe rundll32.exe PID 4188 wrote to memory of 4192 4188 rundll32.exe rundll32.exe PID 4188 wrote to memory of 4192 4188 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0_WPDSp.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0_WPDSp.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 6203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken