Analysis
-
max time kernel
89s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-06-2022 16:41
Static task
static1
Behavioral task
behavioral1
Sample
is0wuuwa.dll
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
is0wuuwa.dll
-
Size
538KB
-
MD5
04485fad82d561bffe7e83dd47d81d7f
-
SHA1
133e7eb3593afb3f05e1c1f72f525c10a237dcb6
-
SHA256
3f1ada78b282636a9edbac8f7fef7fe53e2ed62b2b732aed16e9ecfcb5cc04c7
-
SHA512
6d8fadc784c8d975dee3b87b1e8ba301ca2107b5452f772083d3f6845a274d79b5c773409180f89e51bea860e75df9886ae4a07b88480cd3fb6d14ebd57c97a6
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
77.220.64.146:443
85.25.134.43:8172
213.208.134.178:6516
rc4.plain
rc4.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 624 1672 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-55-0x0000000000000000-mapping.dmp
-
memory/624-56-0x00000000763C1000-0x00000000763C3000-memory.dmpFilesize
8KB
-
memory/624-58-0x00000000748A0000-0x0000000074938000-memory.dmpFilesize
608KB
-
memory/624-57-0x00000000748A0000-0x00000000748DD000-memory.dmpFilesize
244KB
-
memory/624-60-0x00000000748A0000-0x0000000074938000-memory.dmpFilesize
608KB
-
memory/624-61-0x00000000748A0000-0x0000000074938000-memory.dmpFilesize
608KB
-
memory/1672-54-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB