Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30-06-2023 12:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
s7yzrmv13.dll
Resource
win7-20230621-en
windows7-x64
3 signatures
150 seconds
General
-
Target
s7yzrmv13.dll
-
Size
476KB
-
MD5
b9df50a14d692e7aac5cf697462379f0
-
SHA1
0ac013a74fa5f75313774fb1c5294a4e0b9a3a75
-
SHA256
0e16f533d18ae86ab8cadc43a44e9ff7fd6586658939b6c60d6ed9201c31f33a
-
SHA512
eeb54214a759e8daef83d0197495b6985db5f37a5a6d8ba3ab941157ded0c149eb6ae3ee930fe7ec5fd22aaee009d0a33c419a9557d4db53c1077c10cb070a9b
-
SSDEEP
12288:e7fimEsIsmY4K08oM1Wd8t5KQhNdv5z2:e7aVRBn7x6jtU
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
23.246.204.126:443
151.106.39.36:8116
103.124.144.123:6891
172.105.78.60:4664
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2008-54-0x00000000750F0000-0x0000000075169000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 2008 1824 rundll32.exe rundll32.exe