Analysis
-
max time kernel
24s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-02-2021 23:21
Static task
static1
Behavioral task
behavioral1
Sample
01cdb9f348a73bf0e81aca0864548c4d1ba215f83418d47e2b885b57d3973ce4.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
01cdb9f348a73bf0e81aca0864548c4d1ba215f83418d47e2b885b57d3973ce4.dll
-
Size
188KB
-
MD5
c44a51809cd56d848ca27b2fb9cc45f8
-
SHA1
f22fdbc4d0535cc356bcf6a5965fb652c0cab8f5
-
SHA256
01cdb9f348a73bf0e81aca0864548c4d1ba215f83418d47e2b885b57d3973ce4
-
SHA512
abdce9282f8ffbaaddd810c14560dac9f8f8f4ccc0324c8d1adf79b4a7ed72cdf1fb01ed59105ab229b5b5ccdff00e72cb05ce2b2b1a5576dab5b3bcd46ed9da
Malware Config
Extracted
Family
dridex
Botnet
111
C2
209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1140-3-0x0000000073DA0000-0x0000000073DD1000-memory.dmp dridex_ldr behavioral2/memory/1140-5-0x0000000073DA0000-0x0000000073DBF000-memory.dmp dridex_ldr -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 16 1140 rundll32.exe 18 1140 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 8 wrote to memory of 1140 8 rundll32.exe rundll32.exe PID 8 wrote to memory of 1140 8 rundll32.exe rundll32.exe PID 8 wrote to memory of 1140 8 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01cdb9f348a73bf0e81aca0864548c4d1ba215f83418d47e2b885b57d3973ce4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01cdb9f348a73bf0e81aca0864548c4d1ba215f83418d47e2b885b57d3973ce4.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1140-2-0x0000000000000000-mapping.dmp
-
memory/1140-3-0x0000000073DA0000-0x0000000073DD1000-memory.dmpFilesize
196KB
-
memory/1140-4-0x0000000003030000-0x0000000003036000-memory.dmpFilesize
24KB
-
memory/1140-5-0x0000000073DA0000-0x0000000073DBF000-memory.dmpFilesize
124KB