Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 20:21
Static task
static1
General
-
Target
65b2a71e8172d5d4e07102152c69eede97d2ceb1da8c00b83af53a037eb41bea.dll
-
Size
180KB
-
MD5
24c59e71e91bb28defa958d0461a1e1e
-
SHA1
84bea40928f1036598fd7d1f102951e6b36a9424
-
SHA256
65b2a71e8172d5d4e07102152c69eede97d2ceb1da8c00b83af53a037eb41bea
-
SHA512
3239aab1150504a14a69d586b45718182f61904c8ab06167112d3d86db4c0ac4db5ec7d729c0a71359c5374de724b2471fb346861f9b9f62164810ecbcf522a1
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
212.237.17.99:443
176.28.17.160:6602
51.254.140.238:8333
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3804-116-0x00000000737C0000-0x00000000737EF000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 776 3804 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe 776 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 776 WerFault.exe Token: SeBackupPrivilege 776 WerFault.exe Token: SeDebugPrivilege 776 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1680 wrote to memory of 3804 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 3804 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 3804 1680 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65b2a71e8172d5d4e07102152c69eede97d2ceb1da8c00b83af53a037eb41bea.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65b2a71e8172d5d4e07102152c69eede97d2ceb1da8c00b83af53a037eb41bea.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 6243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken