Analysis

  • max time kernel
    121s
  • max time network
    135s
  • submitted
    01-01-1970 00:00

General

  • Target

    4f89e45c1b309a812cf2850be6b771867aaeb89f8b257f7a074df75956246c8c.dll

  • Size

    750KB

  • MD5

    9b4c47baaa538bf729df632919c57d7e

  • SHA1

    134fe5e81abe7760d15eaa89c9763d27806d03f7

  • SHA256

    4f89e45c1b309a812cf2850be6b771867aaeb89f8b257f7a074df75956246c8c

  • SHA512

    d6acefec262b521e0d88dfa1665d25f41d5b8889adc55dfbe5cb1241dd96e88246b52da823af3c37eb00e48129837c15972a4655d6774f1bd9b989b8b7cf83f5

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

192.46.210.220:443

143.244.140.214:808

45.77.0.96:6891

185.56.219.47:8116

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f89e45c1b309a812cf2850be6b771867aaeb89f8b257f7a074df75956246c8c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f89e45c1b309a812cf2850be6b771867aaeb89f8b257f7a074df75956246c8c.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Checks whether UAC is enabled
      PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3116-115-0x0000000000000000-mapping.dmp
  • memory/3116-116-0x0000000073E30000-0x0000000073EF9000-memory.dmp
    Filesize

    804KB

  • memory/3116-118-0x0000000073E30000-0x0000000073EF9000-memory.dmp
    Filesize

    804KB

  • memory/3116-117-0x0000000073E30000-0x0000000073E6D000-memory.dmp
    Filesize

    244KB

  • memory/3116-120-0x0000000003060000-0x0000000003061000-memory.dmp
    Filesize

    4KB

  • memory/3116-121-0x0000000003060000-0x0000000003061000-memory.dmp
    Filesize

    4KB

  • memory/3116-122-0x0000000003060000-0x0000000003061000-memory.dmp
    Filesize

    4KB

  • memory/3116-192-0x0000000003000000-0x000000000314A000-memory.dmp
    Filesize

    1.3MB