Analysis
-
max time kernel
120s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 05:10
Static task
static1
Behavioral task
behavioral1
Sample
era5ne6.dll
Resource
win7-20220715-en
windows7-x64
5 signatures
150 seconds
General
-
Target
era5ne6.dll
-
Size
373KB
-
MD5
c379b0ae73d8763711c50f57607979fe
-
SHA1
2affa7b64aa34b84172bbdcd8c5a09f340e6a328
-
SHA256
ace691c336e0c9a311681ccd4768d52feacc30e13e667ee577a590bff837caa9
-
SHA512
6790ecd81dd943fdde0f9c03348a8c8f3d0f1a936c89ad3863def66848dc4de58af71d66e6da4a0d54d394d1182897e1c9eb66d64f159886adec3e1d34476e2b
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
210.65.244.179:443
37.247.35.130:6601
103.18.108.116:6601
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 39 2116 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4320 wrote to memory of 2116 4320 rundll32.exe rundll32.exe PID 4320 wrote to memory of 2116 4320 rundll32.exe rundll32.exe PID 4320 wrote to memory of 2116 4320 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\era5ne6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\era5ne6.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-130-0x0000000000000000-mapping.dmp
-
memory/2116-132-0x0000000075830000-0x00000000758EC000-memory.dmpFilesize
752KB
-
memory/2116-131-0x0000000075830000-0x000000007586D000-memory.dmpFilesize
244KB
-
memory/2116-134-0x0000000075830000-0x00000000758EC000-memory.dmpFilesize
752KB