Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 13:59
Static task
static1
Behavioral task
behavioral1
Sample
98e5719750aa827bfac863c6b5cf5e191a30be9b34ecce5288b1e8b4ed3511f6.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
98e5719750aa827bfac863c6b5cf5e191a30be9b34ecce5288b1e8b4ed3511f6.dll
-
Size
320KB
-
MD5
d8fdc7428644b131fc21f17e165e640d
-
SHA1
84c877a62164f808fe457f737e9cd98a251803d0
-
SHA256
98e5719750aa827bfac863c6b5cf5e191a30be9b34ecce5288b1e8b4ed3511f6
-
SHA512
03fdb97d02d50f2599ff26069a040db3bcbdaf047f9474cb1763517478b5cd1128cf05f47ffa4b296646cabe36a677e00af279626a266ba648185a70aa637998
Malware Config
Extracted
Family
dridex
Botnet
10555
C2
51.75.24.85:443
46.22.116.163:3074
173.249.46.113:3889
192.241.174.45:4443
rc4.plain
rc4.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1944 1648 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98e5719750aa827bfac863c6b5cf5e191a30be9b34ecce5288b1e8b4ed3511f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98e5719750aa827bfac863c6b5cf5e191a30be9b34ecce5288b1e8b4ed3511f6.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1944-54-0x0000000000000000-mapping.dmp
-
memory/1944-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1944-56-0x0000000074730000-0x0000000074781000-memory.dmpFilesize
324KB
-
memory/1944-59-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB