Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll
-
Size
496KB
-
MD5
5b28c15f07945e94eeb6bfdd9bf27a3b
-
SHA1
999ed45d2cf15e138bb61eda6bb21988d4bc20a4
-
SHA256
3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6
-
SHA512
7e842887e4b13a53d381245cf03d6f78cd99372d861bea25d5f97f1f5b4a4f3c238ebb03e0afea86c94318f070f1900274eca54cbcd6992af010c63cf13690ec
Malware Config
Extracted
Family
dridex
C2
176.126.243.82:443
167.114.122.37:691
66.34.201.20:8443
46.105.111.191:691
Signatures
-
Processes:
resource yara_rule behavioral2/memory/944-134-0x0000000002BF0000-0x0000000002C11000-memory.dmp dridex_ldr behavioral2/memory/944-135-0x0000000002BF0000-0x0000000003575000-memory.dmp dridex_ldr behavioral2/memory/944-137-0x0000000002BF1000-0x0000000002C35000-memory.dmp dridex_ldr behavioral2/memory/944-140-0x0000000002BF0000-0x0000000003575000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4740 wrote to memory of 944 4740 rundll32.exe rundll32.exe PID 4740 wrote to memory of 944 4740 rundll32.exe rundll32.exe PID 4740 wrote to memory of 944 4740 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c973145f59f2676b697315bccf0e532fa1e94abee4f8d9c6195a2eaaecddef6.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/944-130-0x0000000000000000-mapping.dmp
-
memory/944-131-0x0000000002BF0000-0x0000000003575000-memory.dmpFilesize
9.5MB
-
memory/944-133-0x0000000002BF0000-0x0000000003575000-memory.dmpFilesize
9.5MB
-
memory/944-134-0x0000000002BF0000-0x0000000002C11000-memory.dmpFilesize
132KB
-
memory/944-135-0x0000000002BF0000-0x0000000003575000-memory.dmpFilesize
9.5MB
-
memory/944-137-0x0000000002BF1000-0x0000000002C35000-memory.dmpFilesize
272KB
-
memory/944-140-0x0000000002BF0000-0x0000000003575000-memory.dmpFilesize
9.5MB