Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 06:20
Static task
static1
Behavioral task
behavioral1
Sample
ZIjtDcrLmNbNAphkkklgbtq.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ZIjtDcrLmNbNAphkkklgbtq.dll
-
Size
512KB
-
MD5
48773854152142e74bc51a76e53daea9
-
SHA1
ee19541476f0d3fcfa7644f7526da03c089f6870
-
SHA256
8e7e96c5c81defe501dcb530e7cc3773df9f2d2601e7a559cdea4286b920f915
-
SHA512
041c23fe6b6515de6f937cf3859fd2e3436c6b50b3fb06e0048f2052e42c11621d6415347ca602f568c8752e55a60345694154acd1bf5c339bc4e6e288365d32
Malware Config
Extracted
Family
dridex
Botnet
22203
C2
51.159.52.196:443
134.209.247.135:6602
194.233.68.48:5228
89.31.56.58:593
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1160-56-0x0000000074600000-0x0000000074681000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1128 1160 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1784 wrote to memory of 1160 1784 rundll32.exe rundll32.exe PID 1160 wrote to memory of 1128 1160 rundll32.exe WerFault.exe PID 1160 wrote to memory of 1128 1160 rundll32.exe WerFault.exe PID 1160 wrote to memory of 1128 1160 rundll32.exe WerFault.exe PID 1160 wrote to memory of 1128 1160 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ZIjtDcrLmNbNAphkkklgbtq.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ZIjtDcrLmNbNAphkkklgbtq.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 3003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-58-0x0000000000000000-mapping.dmp
-
memory/1160-54-0x0000000000000000-mapping.dmp
-
memory/1160-55-0x0000000074C81000-0x0000000074C83000-memory.dmpFilesize
8KB
-
memory/1160-56-0x0000000074600000-0x0000000074681000-memory.dmpFilesize
516KB
-
memory/1160-59-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB