Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 05:14
Static task
static1
Behavioral task
behavioral1
Sample
jknhou4k.dll
Resource
win7-20220715-en
windows7-x64
5 signatures
150 seconds
General
-
Target
jknhou4k.dll
-
Size
785KB
-
MD5
adae957f96ecb08a9271bcbe38da2cc5
-
SHA1
acfaf6b3f0f2c97446e14567ba3fb4d101464ff4
-
SHA256
6860b23431c03b24449bf266854150b9a1afe5978b84f53803d446696a0e3621
-
SHA512
9018c290c9bb7ccd576a7dac15ddc1cc4051a9e6026a7013328984f0874638814197ffbb0adda8ee6a43e7d77b6de279585459e0bf12d6eeb2676b99edc150b6
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 39 1668 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1932 wrote to memory of 1668 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 1668 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 1668 1932 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jknhou4k.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jknhou4k.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-133-0x0000000000000000-mapping.dmp
-
memory/1668-135-0x00000000750F0000-0x000000007520B000-memory.dmpFilesize
1.1MB
-
memory/1668-134-0x00000000750F0000-0x000000007512D000-memory.dmpFilesize
244KB
-
memory/1668-137-0x00000000750F0000-0x000000007520B000-memory.dmpFilesize
1.1MB
-
memory/1668-138-0x00000000750F0000-0x000000007520B000-memory.dmpFilesize
1.1MB