Analysis
-
max time kernel
124s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 07:03
Static task
static1
General
-
Target
9bc7a09197b831cabb805ccf254287fa1dcf4f8d342d334ce6271028b0e3c645.dll
-
Size
608KB
-
MD5
a0cd9337944c56930ef6017d5ba105c2
-
SHA1
b594125bffe24ef1d75e6298fe04607d6ee730fe
-
SHA256
9bc7a09197b831cabb805ccf254287fa1dcf4f8d342d334ce6271028b0e3c645
-
SHA512
a04a610cf0f0aef40e9e1cd50b4502709a84efd3e45bc32a52760338c61b6d1aaaccca620771ef9d6df33be027d8b6c41c2609a7544392f049e5e950af3f82c6
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 28 1804 rundll32.exe 29 1804 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3580 wrote to memory of 1804 3580 rundll32.exe rundll32.exe PID 3580 wrote to memory of 1804 3580 rundll32.exe rundll32.exe PID 3580 wrote to memory of 1804 3580 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9bc7a09197b831cabb805ccf254287fa1dcf4f8d342d334ce6271028b0e3c645.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9bc7a09197b831cabb805ccf254287fa1dcf4f8d342d334ce6271028b0e3c645.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1804-115-0x0000000000000000-mapping.dmp
-
memory/1804-116-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/1804-117-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1804-118-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/1804-121-0x00000000010F0000-0x00000000010F1000-memory.dmpFilesize
4KB
-
memory/1804-120-0x00000000010F0000-0x00000000010F1000-memory.dmpFilesize
4KB
-
memory/1804-122-0x00000000010F0000-0x00000000010F1000-memory.dmpFilesize
4KB
-
memory/1804-192-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB