Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 20:21
Static task
static1
General
-
Target
9a28abb1d55dfef5eb71317b95445442f2c7b8e094e0480ecb8a0e0c13274934.dll
-
Size
180KB
-
MD5
339008271ae6018ecaa401fb76bb1db0
-
SHA1
c78c07b6476897489c5c5c40fafa0c5657ff9d61
-
SHA256
9a28abb1d55dfef5eb71317b95445442f2c7b8e094e0480ecb8a0e0c13274934
-
SHA512
821f4354446c889d377b9b3c523f2be8ea3ddd6b1f4b6d9c161a5057847ed353d3a9298bdd0e14bcd7b1966a65078d2a7a639b0a9ac1b1c84ec0a4fa60456de3
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
212.237.17.99:443
176.28.17.160:6602
51.254.140.238:8333
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3664-116-0x0000000073700000-0x000000007372F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3932 3664 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3932 WerFault.exe Token: SeBackupPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 3932 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3568 wrote to memory of 3664 3568 rundll32.exe rundll32.exe PID 3568 wrote to memory of 3664 3568 rundll32.exe rundll32.exe PID 3568 wrote to memory of 3664 3568 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a28abb1d55dfef5eb71317b95445442f2c7b8e094e0480ecb8a0e0c13274934.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a28abb1d55dfef5eb71317b95445442f2c7b8e094e0480ecb8a0e0c13274934.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken