ta505 | b02e02ff9b225ad1d2d295800005675fbf2dacd2899b5b939e1070aa2de623e1

Analysis

Target

rtdt.dll
Size

324KB
MD5

f1df801459853f42662c0f947518d3e7
SHA1

15e292ab8c863f2ba97244ed3f6cb226980580e9
SHA256

b02e02ff9b225ad1d2d295800005675fbf2dacd2899b5b939e1070aa2de623e1
SHA512

a06911c0e062dc0d6d8803ea4a0332ea8097839d03f3a382b104e78c82d57685aa199033c582936823115253a65f0883e4d0b76c8988d7319e5bed29f9618d13

Score

10^/10

ta505 upx

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505

Blocklisted process makes network request 1 IoCs

flow	pid	Process
23	3540	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3540-132-0x0000000010000000-0x0000000010052000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	rundll32.exe
3540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3540	2188	rundll32.exe	81
PID 2188 wrote to memory of 3540	2188	rundll32.exe	81
PID 2188 wrote to memory of 3540	2188	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rtdt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rtdt.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

memory/3540-131-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3540-132-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download