Analysis
-
max time kernel
43s -
max time network
100s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 12:00
Static task
static1
Behavioral task
behavioral1
Sample
by9zwa7p1zip.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
by9zwa7p1zip.dll
-
Size
522KB
-
MD5
bb8cc78abb3842b7ca959a37d1654402
-
SHA1
e55142f154e399bd9a96558f8b660702d4429d9d
-
SHA256
b9bb671587f2dad8a3df83d6bd0b7b8327edf93fadbefe8b6aa7eabe6698ae88
-
SHA512
330a383dd1d361940d2a578a1769e2acdb25bccbc4f0d25f62150f6b8b2621bb3b3dee7cf583b3d26913cb929b665bd516d252e3e31af6628cf654a1d2737db0
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1204-5-0x0000000074A40000-0x0000000074A7D000-memory.dmp dridex_ldr behavioral1/memory/1204-6-0x0000000074A40000-0x0000000074A7D000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1204 1740 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-8-0x000007FEF63D0000-0x000007FEF664A000-memory.dmpFilesize
2.5MB
-
memory/1204-3-0x0000000000000000-mapping.dmp
-
memory/1204-4-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/1204-5-0x0000000074A40000-0x0000000074A7D000-memory.dmpFilesize
244KB
-
memory/1204-6-0x0000000074A40000-0x0000000074A7D000-memory.dmpFilesize
244KB
-
memory/1204-7-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1740-2-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB