Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0096b8ee32919476582939bab5314c50.dll
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
0096b8ee32919476582939bab5314c50.dll
-
Size
188KB
-
MD5
0096b8ee32919476582939bab5314c50
-
SHA1
fd2a0e13487b80ca2cdb98f5d3c94f4c7c296c85
-
SHA256
9c5c20ec32d094ded1ed893a25149a1c11acd81c764db4d5808e9a0c2cd37d01
-
SHA512
4c58173cc543ad791fa2fdf959323e13b7b16f3fcc113144188cf0ceac67e128aa60487eb860eccbbc4690f6eea3772767da38c3d7839249910ad4a4bf6cf11e
-
SSDEEP
3072:GA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:GzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2532-0-0x00000000747F0000-0x0000000074820000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1920 2532 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 1752 wrote to memory of 2532 1752 rundll32.exe 28 PID 2532 wrote to memory of 1920 2532 rundll32.exe 29 PID 2532 wrote to memory of 1920 2532 rundll32.exe 29 PID 2532 wrote to memory of 1920 2532 rundll32.exe 29 PID 2532 wrote to memory of 1920 2532 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0096b8ee32919476582939bab5314c50.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0096b8ee32919476582939bab5314c50.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 3003⤵
- Program crash
PID:1920
-
-