Analysis
-
max time kernel
122s -
max time network
127s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
9a58955c8271d01454ce5e770017487e.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
9a58955c8271d01454ce5e770017487e.dll
-
Size
750KB
-
MD5
9a58955c8271d01454ce5e770017487e
-
SHA1
2169c63d3195e44ea21da0a847729e7a1d55f671
-
SHA256
469ffa8513bae4dda107dc8f20273f930ccd02c08ba38b5d7166c8f99f12b5b0
-
SHA512
3d7bad97a18a26304df188167b39d30d32b7e6d88f75c3350d22773feae4a47d7653578cff10f9a958d785f0356111f6961f0ab96f6311b592b76ab531cdbaba
Malware Config
Extracted
Family
dridex
Botnet
10555
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 23 4004 rundll32.exe 24 4004 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4040 wrote to memory of 4004 4040 rundll32.exe rundll32.exe PID 4040 wrote to memory of 4004 4040 rundll32.exe rundll32.exe PID 4040 wrote to memory of 4004 4040 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a58955c8271d01454ce5e770017487e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a58955c8271d01454ce5e770017487e.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4004-115-0x0000000000000000-mapping.dmp
-
memory/4004-116-0x00000000741F0000-0x00000000742B9000-memory.dmpFilesize
804KB
-
memory/4004-118-0x00000000741F0000-0x00000000742B9000-memory.dmpFilesize
804KB
-
memory/4004-117-0x00000000741F0000-0x000000007422D000-memory.dmpFilesize
244KB
-
memory/4004-120-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/4004-122-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/4004-121-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/4004-123-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB