Analysis
-
max time kernel
115s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 05:04
Static task
static1
Behavioral task
behavioral1
Sample
ApFhLhTicsyXRYxkkklgbtq.dll
Resource
win7-20220715-en
windows7-x64
4 signatures
150 seconds
General
-
Target
ApFhLhTicsyXRYxkkklgbtq.dll
-
Size
512KB
-
MD5
1eb320594f3068a85f3f207d46917950
-
SHA1
d10ca727d9113e25db4f26ae616af68ca9d2fc25
-
SHA256
7319faf4a324a7aec6b898b06f822b59f24a2c702929a146908829c5ddccfe83
-
SHA512
ceb958e62039725b1a47bf07fcc65ffe37024a975515acffe2b022998e3531facf452147da61dd33d3c76bd63b1ce0b3da399e511336a05a11963e1083c13850
Malware Config
Extracted
Family
dridex
Botnet
22203
C2
51.159.52.196:443
134.209.247.135:6602
194.233.68.48:5228
89.31.56.58:593
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4068-132-0x0000000075120000-0x00000000751A1000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2628 4068 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3568 wrote to memory of 4068 3568 rundll32.exe rundll32.exe PID 3568 wrote to memory of 4068 3568 rundll32.exe rundll32.exe PID 3568 wrote to memory of 4068 3568 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ApFhLhTicsyXRYxkkklgbtq.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ApFhLhTicsyXRYxkkklgbtq.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 6523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4068 -ip 40681⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4068-130-0x0000000000000000-mapping.dmp
-
memory/4068-131-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB
-
memory/4068-132-0x0000000075120000-0x00000000751A1000-memory.dmpFilesize
516KB
-
memory/4068-134-0x0000000000CB0000-0x0000000000CB6000-memory.dmpFilesize
24KB