Analysis
-
max time kernel
54s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2023 14:33
Static task
static1
Behavioral task
behavioral1
Sample
04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765.dll
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765.dll
-
Size
158KB
-
MD5
6c3918f69235c7fef8e48d04106c93a0
-
SHA1
5d1807e6ddf88e1ccea39230c8ad7e8c10cc689e
-
SHA256
04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765
-
SHA512
afa9ffb594b8a3e1e1674c9ce8d712ba867918b8fc4975a241f2ba760313422efebc0644dc1ee0d0cc2b42f017e76297da2dba7c2f04ca979edbafb64a5325a1
-
SSDEEP
3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z
Malware Config
Extracted
Family
dridex
Botnet
40112
C2
8.210.53.215:443
72.249.22.245:2303
188.40.137.206:8172
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3008-133-0x00000000756B0000-0x00000000756DD000-memory.dmp dridex_ldr behavioral2/memory/3008-135-0x00000000756B0000-0x00000000756DD000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4392 wrote to memory of 3008 4392 rundll32.exe rundll32.exe PID 4392 wrote to memory of 3008 4392 rundll32.exe rundll32.exe PID 4392 wrote to memory of 3008 4392 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765.dll,#12⤵
- Checks whether UAC is enabled