Analysis
-
max time kernel
197s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 05:50
Static task
static1
Behavioral task
behavioral1
Sample
og27ksp6.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
og27ksp6.dll
-
Size
1.0MB
-
MD5
f6513fd9bb92c2eecb2bee88d7a221a3
-
SHA1
f2358c1c65a3d76fdd29018c76915971fe91ee5b
-
SHA256
4850bb885ea9c2266d592c33de4e326555cee54156978afbc846f75836b991ae
-
SHA512
204948b212553665e4b31169f5bafe500cc5735af1da05fa722d26b4ea76cf2c004b7a36488936b873c83bfd34c59e8acd623922306a4c851b5a306c8ef3766e
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 22 1564 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3364 wrote to memory of 1564 3364 rundll32.exe rundll32.exe PID 3364 wrote to memory of 1564 3364 rundll32.exe rundll32.exe PID 3364 wrote to memory of 1564 3364 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\og27ksp6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\og27ksp6.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1564-130-0x0000000000000000-mapping.dmp
-
memory/1564-131-0x00000000755E0000-0x00000000756FB000-memory.dmpFilesize
1.1MB
-
memory/1564-133-0x00000000755E0000-0x00000000756FB000-memory.dmpFilesize
1.1MB
-
memory/1564-132-0x00000000755E0000-0x000000007561D000-memory.dmpFilesize
244KB
-
memory/1564-135-0x00000000755E0000-0x00000000756FB000-memory.dmpFilesize
1.1MB