Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 17:05
Static task
static1
Behavioral task
behavioral1
Sample
0_WPDSp.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0_WPDSp.dll
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
4_aepdu.dll
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
4_aepdu.dll
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
8_hp8500at.dll
Resource
win7-en-20211014
General
-
Target
4_aepdu.dll
-
Size
180KB
-
MD5
339008271ae6018ecaa401fb76bb1db0
-
SHA1
c78c07b6476897489c5c5c40fafa0c5657ff9d61
-
SHA256
9a28abb1d55dfef5eb71317b95445442f2c7b8e094e0480ecb8a0e0c13274934
-
SHA512
821f4354446c889d377b9b3c523f2be8ea3ddd6b1f4b6d9c161a5057847ed353d3a9298bdd0e14bcd7b1966a65078d2a7a639b0a9ac1b1c84ec0a4fa60456de3
Malware Config
Extracted
dridex
22201
212.237.17.99:443
176.28.17.160:6602
51.254.140.238:8333
Signatures
-
Processes:
resource yara_rule behavioral3/memory/1088-57-0x0000000074CE0000-0x0000000074D0F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 288 1088 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 288 WerFault.exe 288 WerFault.exe 288 WerFault.exe 288 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 288 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1644 wrote to memory of 1088 1644 rundll32.exe rundll32.exe PID 1088 wrote to memory of 288 1088 rundll32.exe WerFault.exe PID 1088 wrote to memory of 288 1088 rundll32.exe WerFault.exe PID 1088 wrote to memory of 288 1088 rundll32.exe WerFault.exe PID 1088 wrote to memory of 288 1088 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4_aepdu.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4_aepdu.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 2523⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-59-0x0000000000000000-mapping.dmp
-
memory/288-61-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/1088-55-0x0000000000000000-mapping.dmp
-
memory/1088-56-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1088-57-0x0000000074CE0000-0x0000000074D0F000-memory.dmpFilesize
188KB
-
memory/1088-60-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB