ta505 | e10fa45aa8fff5891a60afb5f15c2a8b3827b425b59656a0dc114cb7dd8d419f | Triage

Analysis

max time kernel
3s
max time network
41s
platform
windows7_x64
resource
win7v20210410
submitted
14-07-2021 13:22

Sharing

Report Analysis Logs

General

Target

574e9f8074520690b36e5169a331263b .dll
Size

497KB
MD5

574e9f8074520690b36e5169a331263b
SHA1

cd2e237fbb2e183acc02528288edd34ca777b8c6
SHA256

e10fa45aa8fff5891a60afb5f15c2a8b3827b425b59656a0dc114cb7dd8d419f
SHA512

cfd1f9ad19a271022eb2e53e3100a15ee7fc931721aaed3fc532715e7041aa703f8d75b36e9d0d0750d7832112dd61cc129e63f0b2b0009880935a3b3daefdfe

Score

10^/10

ta505

Malware Config

Signatures

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1980 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1980	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ 574e9f8074520690b36e5169a331263b .dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ 574e9f8074520690b36e5169a331263b .dll",#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-59-0x0000000000000000-mapping.dmp

Download
memory/1980-60-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download
memory/1980-62-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/1980-61-0x0000000000160000-0x000000000019C000-memory.dmp

Filesize
240KB

Download