Analysis
-
max time kernel
118s -
max time network
156s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
1160ebaccddff549689f5a23fe1f5b8f.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
1160ebaccddff549689f5a23fe1f5b8f.dll
-
Size
750KB
-
MD5
1160ebaccddff549689f5a23fe1f5b8f
-
SHA1
11d658e99b552c3b5de915b2121aabec2f1797f8
-
SHA256
0d22bc5c2660001ba4b10e2f2606985f9675f667e0a28f4b65c3cbb83114fef2
-
SHA512
bf65a6cb1b094461fe6d9bb192461ecba47925cb4801df2394de8425c1ab2b345dd14020db4d2c051f8669b8462817a5e0c8d213a73c6766f6d06954723976c6
Malware Config
Extracted
Family
dridex
Botnet
10555
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 25 2796 rundll32.exe 26 2796 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2780 wrote to memory of 2796 2780 rundll32.exe rundll32.exe PID 2780 wrote to memory of 2796 2780 rundll32.exe rundll32.exe PID 2780 wrote to memory of 2796 2780 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1160ebaccddff549689f5a23fe1f5b8f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1160ebaccddff549689f5a23fe1f5b8f.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:2796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2796-118-0x0000000000000000-mapping.dmp
-
memory/2796-119-0x0000000073AC0000-0x0000000073B89000-memory.dmpFilesize
804KB
-
memory/2796-121-0x0000000073AC0000-0x0000000073B89000-memory.dmpFilesize
804KB
-
memory/2796-120-0x0000000073AC0000-0x0000000073AFD000-memory.dmpFilesize
244KB
-
memory/2796-123-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/2796-124-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/2796-125-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/2796-385-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB