Analysis
-
max time kernel
104s -
max time network
147s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
7927ceb3ba1bd526b882c3a798731fb9.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
7927ceb3ba1bd526b882c3a798731fb9.dll
-
Size
750KB
-
MD5
7927ceb3ba1bd526b882c3a798731fb9
-
SHA1
a905d6f8beb8aedc5e106a4be1236598acfa2c48
-
SHA256
2e744f40772c5185423076d877f8f2ab7b8718f3e6cee37bf4e5b5e0b58e4d30
-
SHA512
86c566a46e15f255e3c41853db672e2cbcd7f58670a41b77692bcd72c71e7410b0d30c231e1910d7dddade8b2e24b0fc8fe1186caf3dfa63803106b7ff48f32d
Malware Config
Extracted
Family
dridex
Botnet
10555
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 27 1504 rundll32.exe 28 1504 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1168 wrote to memory of 1504 1168 rundll32.exe rundll32.exe PID 1168 wrote to memory of 1504 1168 rundll32.exe rundll32.exe PID 1168 wrote to memory of 1504 1168 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7927ceb3ba1bd526b882c3a798731fb9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7927ceb3ba1bd526b882c3a798731fb9.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-115-0x0000000000000000-mapping.dmp
-
memory/1504-116-0x00000000743E0000-0x00000000744A9000-memory.dmpFilesize
804KB
-
memory/1504-117-0x00000000743E0000-0x000000007441D000-memory.dmpFilesize
244KB
-
memory/1504-118-0x00000000743E0000-0x00000000744A9000-memory.dmpFilesize
804KB
-
memory/1504-121-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1504-120-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1504-122-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1504-935-0x0000000000B40000-0x0000000000C8A000-memory.dmpFilesize
1.3MB