Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 14:53
Static task
static1
General
-
Target
68681415a776cc885eedfeb2999b49c561e2dbc93b144a8eaefaa19a17f3c3b0.dll
-
Size
664KB
-
MD5
eca6385623a6a20df205cf22de99372c
-
SHA1
03d0767e3bd278d2144a63c8a2e6cc27b93e5777
-
SHA256
68681415a776cc885eedfeb2999b49c561e2dbc93b144a8eaefaa19a17f3c3b0
-
SHA512
350ddc52ca862d58f2c17b0b89dde2be5cde8e437bb6e08f6a0681d576665d047cde1d660b05ec5330f4887f5e3959868dd2e699956b22b428b04915e6e7f507
Malware Config
Extracted
Family
dridex
Botnet
10222
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 46 3584 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2484 wrote to memory of 3584 2484 rundll32.exe rundll32.exe PID 2484 wrote to memory of 3584 2484 rundll32.exe rundll32.exe PID 2484 wrote to memory of 3584 2484 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68681415a776cc885eedfeb2999b49c561e2dbc93b144a8eaefaa19a17f3c3b0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68681415a776cc885eedfeb2999b49c561e2dbc93b144a8eaefaa19a17f3c3b0.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3584-115-0x0000000000000000-mapping.dmp
-
memory/3584-116-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/3584-117-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3584-118-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/3584-120-0x0000000002D20000-0x0000000002D21000-memory.dmpFilesize
4KB
-
memory/3584-121-0x0000000002D20000-0x0000000002D21000-memory.dmpFilesize
4KB
-
memory/3584-122-0x0000000002D20000-0x0000000002D21000-memory.dmpFilesize
4KB
-
memory/3584-1053-0x0000000002C00000-0x0000000002D4A000-memory.dmpFilesize
1.3MB