Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
129a77c3d3ff91004b60bd1f46119afc.dll
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
129a77c3d3ff91004b60bd1f46119afc.dll
-
Size
188KB
-
MD5
129a77c3d3ff91004b60bd1f46119afc
-
SHA1
9d128744e85dadf2b60ff93b398dc628b1b872b6
-
SHA256
f730eb3526c61647dd5b86c53742089c11dcfeb59129ea726b67b6a5d816e0e9
-
SHA512
6330caf0a138418e985b262dd2f0639a2921691d813f09e347725b091dbc84147e7bb7f53138bbfa004cac333f7ed031c528d91e53a1694319951ba31bf541f1
-
SSDEEP
3072:PA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoQo:PzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral2/memory/3916-0-0x0000000074B50000-0x0000000074B80000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2332 3916 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 792 wrote to memory of 3916 792 rundll32.exe 15 PID 792 wrote to memory of 3916 792 rundll32.exe 15 PID 792 wrote to memory of 3916 792 rundll32.exe 15
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\129a77c3d3ff91004b60bd1f46119afc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\129a77c3d3ff91004b60bd1f46119afc.dll,#12⤵PID:3916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 6643⤵
- Program crash
PID:2332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3916 -ip 39161⤵PID:4468