Analysis
-
max time kernel
99s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-05-2022 02:28
Static task
static1
Behavioral task
behavioral1
Sample
ynqbj9d.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ynqbj9d.dll
-
Size
504KB
-
MD5
c033932c15f002e82005af6207370743
-
SHA1
68603ee11cb648b29fbf9ac789f16c3c20ab5fb2
-
SHA256
fed976ccb46e9a6679c1c8e141c3f81bce21cf627def54d2d00c3ba56bffa090
-
SHA512
b7bd61d8c6154c9b1fb69349c582f11c3d33430523490813edd1b8c7bc1d8c2b84f26528a63c1780198bc6442c584d687917027ab3add174db343e5728d749bf
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 29 2576 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2572 wrote to memory of 2576 2572 rundll32.exe rundll32.exe PID 2572 wrote to memory of 2576 2572 rundll32.exe rundll32.exe PID 2572 wrote to memory of 2576 2572 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ynqbj9d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ynqbj9d.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2576-130-0x0000000000000000-mapping.dmp
-
memory/2576-131-0x0000000000740000-0x00000000007D1000-memory.dmpFilesize
580KB
-
memory/2576-133-0x0000000000740000-0x00000000007D1000-memory.dmpFilesize
580KB
-
memory/2576-132-0x0000000000740000-0x000000000077D000-memory.dmpFilesize
244KB
-
memory/2576-135-0x0000000000741000-0x000000000079B000-memory.dmpFilesize
360KB
-
memory/2576-137-0x0000000000740000-0x00000000007D1000-memory.dmpFilesize
580KB