Analysis
-
max time kernel
129s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 07:04
Static task
static1
General
-
Target
7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba.dll
-
Size
608KB
-
MD5
e19a53f849c61ed1f4fd3650cd28f809
-
SHA1
5923a4ac13789e5ee87f972b7d711d2e8cb1b8ea
-
SHA256
7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba
-
SHA512
41213fc1a1a01e1c85eb84bf592f920bbb831e373db687b8f32ca6b83f3f332f603c714b6d71e63824eebc2420b222febe01b68895cc774620dae61995a59d7d
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 25 3044 rundll32.exe 26 3044 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3608 wrote to memory of 3044 3608 rundll32.exe rundll32.exe PID 3608 wrote to memory of 3044 3608 rundll32.exe rundll32.exe PID 3608 wrote to memory of 3044 3608 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3044-115-0x0000000000000000-mapping.dmp
-
memory/3044-118-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/3044-117-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3044-120-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/3044-121-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/3044-122-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/3044-130-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/3044-116-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB