Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 16:49
Static task
static1
Behavioral task
behavioral1
Sample
f1j7m5.zip.dll
Resource
win7-en-20210920
0 signatures
0 seconds
General
-
Target
f1j7m5.zip.dll
-
Size
664KB
-
MD5
9c2bc7ccdc66cc3dad587e05f668b9aa
-
SHA1
f5c7c0d639dc90aaa42933e8709269dd96effd71
-
SHA256
044dba2cb102eb631f8bb519b483e6c5b640e2b3e542053f29949e13bb142df2
-
SHA512
3c239e10680d9c08089b7da513ce1416a9f83394757566c4ff53271c3e1776c0c05fd14bc0a2caebee1cbd20427dee4069b74eef362d70511b9f990f7451ff21
Malware Config
Extracted
Family
dridex
Botnet
10222
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 1728 rundll32.exe 5 1728 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1728 1704 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f1j7m5.zip.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f1j7m5.zip.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-54-0x0000000000000000-mapping.dmp
-
memory/1728-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1728-56-0x0000000001D80000-0x0000000001EBC000-memory.dmpFilesize
1.2MB
-
memory/1728-58-0x0000000001D80000-0x0000000001EBC000-memory.dmpFilesize
1.2MB
-
memory/1728-59-0x0000000001D80000-0x0000000001DBD000-memory.dmpFilesize
244KB
-
memory/1728-60-0x0000000001D80000-0x0000000001EBC000-memory.dmpFilesize
1.2MB
-
memory/1728-62-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB