Analysis
-
max time kernel
140s -
max time network
160s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-10-2021 07:04
Static task
static1
General
-
Target
7d1f09ed644fbd815f63f1b3f15c461479e3c28240c3381b25804eea4ed218c7.dll
-
Size
608KB
-
MD5
6c07d252f79ddcd463e5d368c13a08ab
-
SHA1
08547a401c5de08c44d12ecde2d2ed86fe10d798
-
SHA256
7d1f09ed644fbd815f63f1b3f15c461479e3c28240c3381b25804eea4ed218c7
-
SHA512
ade8efa81ce840223aa957cc9c870fb539bb3f2bc15c26ab019ea996ee056319483f6cce910e138e7d9bd78aa30551103ffe9eb4bbdb16de1656488bff7b36a9
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 29 2792 rundll32.exe 31 2792 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1400 wrote to memory of 2792 1400 rundll32.exe rundll32.exe PID 1400 wrote to memory of 2792 1400 rundll32.exe rundll32.exe PID 1400 wrote to memory of 2792 1400 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d1f09ed644fbd815f63f1b3f15c461479e3c28240c3381b25804eea4ed218c7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d1f09ed644fbd815f63f1b3f15c461479e3c28240c3381b25804eea4ed218c7.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2792-114-0x0000000000000000-mapping.dmp
-
memory/2792-115-0x0000000000C20000-0x0000000000D54000-memory.dmpFilesize
1.2MB
-
memory/2792-117-0x0000000000C20000-0x0000000000D54000-memory.dmpFilesize
1.2MB
-
memory/2792-119-0x0000000000C20000-0x0000000000D54000-memory.dmpFilesize
1.2MB
-
memory/2792-118-0x0000000000C20000-0x0000000000C5D000-memory.dmpFilesize
244KB
-
memory/2792-122-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/2792-121-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/2792-123-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/2792-495-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB