Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll
-
Size
496KB
-
MD5
5b28c15f07945e94eeb6bfdd9bf27a3b
-
SHA1
999ed45d2cf15e138bb61eda6bb21988d4bc20a4
-
SHA256
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6
-
SHA512
7e842887e4b13a53d381245cf03d6f78cd99372d861bea25d5f97f1f5b4a4f3c238ebb03e0afea86c94318f070f1900274eca54cbcd6992af010c63cf13690ec
Malware Config
Extracted
Family
dridex
C2
176.126.243.82:443
167.114.122.37:691
66.34.201.20:8443
46.105.111.191:691
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1824-59-0x0000000001FE0000-0x0000000002001000-memory.dmp dridex_ldr behavioral1/memory/1824-60-0x0000000001FE0000-0x0000000002965000-memory.dmp dridex_ldr behavioral1/memory/1824-62-0x0000000001FE0000-0x0000000002965000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-54-0x0000000000000000-mapping.dmp
-
memory/1824-55-0x00000000768D1000-0x00000000768D3000-memory.dmpFilesize
8KB
-
memory/1824-56-0x0000000001FE0000-0x0000000002965000-memory.dmpFilesize
9.5MB
-
memory/1824-58-0x0000000001FE0000-0x0000000002965000-memory.dmpFilesize
9.5MB
-
memory/1824-59-0x0000000001FE0000-0x0000000002001000-memory.dmpFilesize
132KB
-
memory/1824-60-0x0000000001FE0000-0x0000000002965000-memory.dmpFilesize
9.5MB
-
memory/1824-62-0x0000000001FE0000-0x0000000002965000-memory.dmpFilesize
9.5MB