DllRegisterServer
Behavioral task
behavioral1
Sample
malware.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
malware.dll
Resource
win10v2004-20220812-en
General
-
Target
dd4f6a499d67d8b8ad0ba966a89691ab9ac75fa2
-
Size
106KB
-
MD5
fbeaf7a18e3914371c8df6463137c3af
-
SHA1
dd4f6a499d67d8b8ad0ba966a89691ab9ac75fa2
-
SHA256
7f320231eb91b1495083a525341dbbb38a55017230dbb4f3a105f2c33dcc6a3b
-
SHA512
26f86e24f09eee1ff442322858f728e3581229ce34dcccb4969ffea53d9716fbe46769e4a05aa864e9738bc0d6cf177c3a2839fec18e00345d65a2ed03088767
-
SSDEEP
3072:svIAzMibUufqZ4Xf4FeaBXwvkZTPAbb75vbU/aDm:hibY4XwBXzAbbtvbU/aDm
Malware Config
Extracted
dridex
10444
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
Signatures
-
Dridex family
Files
-
dd4f6a499d67d8b8ad0ba966a89691ab9ac75fa2.7z
-
malware.bin.dll regsvr32 windows x86
1e514447f004e9505dc193777ba8a65d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
Sleep
Exports
Exports
Sections
.text Size: 208KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ