Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 06:15
Static task
static1
Behavioral task
behavioral1
Sample
wisr1qas.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
wisr1qas.dll
-
Size
476KB
-
MD5
f7703084b13482c646f3851e18d8951a
-
SHA1
939ff0c3db869fa5656b6905f824fdb69050e43c
-
SHA256
b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495
-
SHA512
1c9e8a129bf0a634582343f14283d5bf152adc58f51230bf288482f49c5605c62b320ae1577571faf039a2b6c070985c251fa0f4a804e1dc98e287f087273498
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
23.246.204.126:443
151.106.39.36:8116
103.124.144.123:6891
172.105.78.60:4664
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4456-132-0x0000000075630000-0x00000000756A9000-memory.dmp dridex_ldr -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 388 4456 WerFault.exe rundll32.exe 2176 4456 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3980 wrote to memory of 4456 3980 rundll32.exe rundll32.exe PID 3980 wrote to memory of 4456 3980 rundll32.exe rundll32.exe PID 3980 wrote to memory of 4456 3980 rundll32.exe rundll32.exe PID 4456 wrote to memory of 388 4456 rundll32.exe WerFault.exe PID 4456 wrote to memory of 388 4456 rundll32.exe WerFault.exe PID 4456 wrote to memory of 388 4456 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wisr1qas.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wisr1qas.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4456 -ip 44561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-135-0x0000000000000000-mapping.dmp
-
memory/4456-130-0x0000000000000000-mapping.dmp
-
memory/4456-131-0x0000000002E70000-0x0000000002E76000-memory.dmpFilesize
24KB
-
memory/4456-132-0x0000000075630000-0x00000000756A9000-memory.dmpFilesize
484KB
-
memory/4456-134-0x0000000002E70000-0x0000000002E76000-memory.dmpFilesize
24KB