Analysis
-
max time kernel
31s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-06-2022 16:52
Static task
static1
Behavioral task
behavioral1
Sample
ow571qp9x.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ow571qp9x.dll
-
Size
476KB
-
MD5
edd5e7e742a9cf2c2b410d9208278042
-
SHA1
f1db2c4189850281f2fa163903750e7e549ee165
-
SHA256
fa6aea596a04b6bd957babd156bbd40cafa2b0662390cc2fd30953fb48ec61fc
-
SHA512
1c550da3d70359464b1082c93f76bad93aaa0bd059d6d5c3a80bd5808352b68e3be34b6574ae5a569f54cdbb120619cbede08ebfbb7ba455482159d80b400b73
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
23.246.204.126:443
151.106.39.36:8116
103.124.144.123:6891
172.105.78.60:4664
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1164-56-0x00000000746B0000-0x0000000074729000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 956 1164 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1884 wrote to memory of 1164 1884 rundll32.exe rundll32.exe PID 1164 wrote to memory of 956 1164 rundll32.exe WerFault.exe PID 1164 wrote to memory of 956 1164 rundll32.exe WerFault.exe PID 1164 wrote to memory of 956 1164 rundll32.exe WerFault.exe PID 1164 wrote to memory of 956 1164 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ow571qp9x.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ow571qp9x.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 3443⤵
- Program crash
PID:956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/1164-54-0x0000000000000000-mapping.dmp
-
memory/1164-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1164-56-0x00000000746B0000-0x0000000074729000-memory.dmpFilesize
484KB
-
memory/1164-59-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB