Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 12:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
u6uuyrd6u.dll
Resource
win7-20230621-en
5 signatures
150 seconds
General
-
Target
u6uuyrd6u.dll
-
Size
1.0MB
-
MD5
8862af832648036583401dc684dfb37e
-
SHA1
303a5bb159021e54fac7ede1951ee77d3506cf7e
-
SHA256
50dc4263f4b99b452d70aba39f86e2c50cb11c0948488b001aefe61dc7069593
-
SHA512
78df17ff6609053ecec51cad8035c4ea767dcb1339c77029f689e2177cdc6ae7441c92146adbacea3904b8e66610629292d35e803ad044b8486d337560cdfb46
-
SSDEEP
24576:e2c6WRTUUt+HxHGRivPX04OhWqVD6wKhGm31m:nW5tQHlvv0f5B6Vhv31
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
192.46.210.220:443
143.244.140.214:808
45.77.0.96:6891
185.56.219.47:8116
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 22 2192 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2192 2556 rundll32.exe 81 PID 2556 wrote to memory of 2192 2556 rundll32.exe 81 PID 2556 wrote to memory of 2192 2556 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u6uuyrd6u.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u6uuyrd6u.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:2192
-