Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 16:44
Static task
static1
Behavioral task
behavioral1
Sample
katn9wt.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
katn9wt.dll
-
Size
497KB
-
MD5
4c40878a680989564d69aaaad6675b3d
-
SHA1
61ad964d616ed4a29fc0d3172840eced09ecc0ae
-
SHA256
3f7c187c9539e39d8556dfa534e260aa0255d682aee06e3afdcfe4c047bf6e77
-
SHA512
d997c6078564b628a8a45e3a2eb91b4dc177c892e9d3eff9026c7630bacad8344c4f63d5386e57d38381dc1002c53338001dbb4d6cd58b139b64ff2590165f17
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
178.128.83.165:443
128.199.59.13:8172
110.164.184.226:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 49 2928 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2004 wrote to memory of 2928 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2928 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2928 2004 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\katn9wt.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\katn9wt.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2928-130-0x0000000000000000-mapping.dmp
-
memory/2928-132-0x00000000753C0000-0x0000000075453000-memory.dmpFilesize
588KB
-
memory/2928-131-0x00000000753C0000-0x00000000753FD000-memory.dmpFilesize
244KB
-
memory/2928-134-0x00000000753C0000-0x0000000075453000-memory.dmpFilesize
588KB