Analysis
-
max time kernel
125s -
max time network
136s -
submitted
01-01-1970 00:00
Static task
static1
General
-
Target
d1fb509136dea5e9e8873e79a43cd6137d656d4067ac50cb046ecaca400675bb.dll
-
Size
750KB
-
MD5
f54ad059f939dc7d66b0b70598147fca
-
SHA1
648e02d88db633e078dd08e69c31add8cf2db50d
-
SHA256
d1fb509136dea5e9e8873e79a43cd6137d656d4067ac50cb046ecaca400675bb
-
SHA512
7eb751b37e8142047f7bbaede822b67a46885e5d3d5cc66cd455c5c4de6dc01967fcd7e39f49285a0d62a929e9c2bf3e71815e7ba8720e13e481d3fd94e8fb0d
Malware Config
Extracted
Family
dridex
Botnet
10555
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 25 2332 rundll32.exe 26 2332 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3540 wrote to memory of 2332 3540 rundll32.exe rundll32.exe PID 3540 wrote to memory of 2332 3540 rundll32.exe rundll32.exe PID 3540 wrote to memory of 2332 3540 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1fb509136dea5e9e8873e79a43cd6137d656d4067ac50cb046ecaca400675bb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1fb509136dea5e9e8873e79a43cd6137d656d4067ac50cb046ecaca400675bb.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2332-115-0x0000000000000000-mapping.dmp
-
memory/2332-116-0x0000000073EC0000-0x0000000073F89000-memory.dmpFilesize
804KB
-
memory/2332-118-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/2332-117-0x0000000073EC0000-0x0000000073EFD000-memory.dmpFilesize
244KB
-
memory/2332-119-0x0000000073EC0000-0x0000000073F89000-memory.dmpFilesize
804KB
-
memory/2332-121-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/2332-122-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/2332-123-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB