Analysis
-
max time kernel
135s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 16:51
Static task
static1
Behavioral task
behavioral1
Sample
obkj7jnd.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
obkj7jnd.dll
-
Size
785KB
-
MD5
7b06c3c759dca98845688da6a0feada1
-
SHA1
dbb10b7a3bbca728c1e085183a70aa0fa1e72eb7
-
SHA256
e56c7afb6712cd3edda9400e15c8834477a26443575404b22bb92b137289c1b9
-
SHA512
851b3c23e86e2f9925084180bca828c7d9f3f595a3ee683a828d2a8e1726ec6f3f498d1f3be25c231ad7fb6a763d3aff89d6a6e142ea62e9e7df51c3fcc3c4c1
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 23 3704 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2688 wrote to memory of 3704 2688 rundll32.exe rundll32.exe PID 2688 wrote to memory of 3704 2688 rundll32.exe rundll32.exe PID 2688 wrote to memory of 3704 2688 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\obkj7jnd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\obkj7jnd.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3704-130-0x0000000000000000-mapping.dmp
-
memory/3704-131-0x0000000074C40000-0x0000000074C7D000-memory.dmpFilesize
244KB
-
memory/3704-132-0x0000000074C40000-0x0000000074D5B000-memory.dmpFilesize
1.1MB
-
memory/3704-134-0x0000000074C40000-0x0000000074D5B000-memory.dmpFilesize
1.1MB