Analysis
-
max time kernel
108s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 17:06
Static task
static1
Behavioral task
behavioral1
Sample
uwyefyol2.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
uwyefyol2.dll
-
Size
504KB
-
MD5
c033932c15f002e82005af6207370743
-
SHA1
68603ee11cb648b29fbf9ac789f16c3c20ab5fb2
-
SHA256
fed976ccb46e9a6679c1c8e141c3f81bce21cf627def54d2d00c3ba56bffa090
-
SHA512
b7bd61d8c6154c9b1fb69349c582f11c3d33430523490813edd1b8c7bc1d8c2b84f26528a63c1780198bc6442c584d687917027ab3add174db343e5728d749bf
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 24 3076 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3148 wrote to memory of 3076 3148 rundll32.exe rundll32.exe PID 3148 wrote to memory of 3076 3148 rundll32.exe rundll32.exe PID 3148 wrote to memory of 3076 3148 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\uwyefyol2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\uwyefyol2.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3076-130-0x0000000000000000-mapping.dmp
-
memory/3076-131-0x0000000002BD0000-0x0000000002C61000-memory.dmpFilesize
580KB
-
memory/3076-133-0x0000000002BD0000-0x0000000002C61000-memory.dmpFilesize
580KB
-
memory/3076-132-0x0000000002BD0000-0x0000000002C0D000-memory.dmpFilesize
244KB
-
memory/3076-135-0x0000000002BD1000-0x0000000002C2B000-memory.dmpFilesize
360KB
-
memory/3076-137-0x0000000002BD0000-0x0000000002C61000-memory.dmpFilesize
580KB
-
memory/3076-138-0x0000000002BD0000-0x0000000002C61000-memory.dmpFilesize
580KB