Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10c00e9f0b0bc101ec6b6ea9e2e9b2a3.dll
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
10c00e9f0b0bc101ec6b6ea9e2e9b2a3.dll
-
Size
188KB
-
MD5
10c00e9f0b0bc101ec6b6ea9e2e9b2a3
-
SHA1
9c6627d45feeb2cba9a9b09d95f84c4324cfbab0
-
SHA256
f33a6e23e8eba2eb8f2a5a1a6bab5b760b9dbd950d60bd66a9decd6a0e777832
-
SHA512
c81a214ad32569ba5b01ea5a875727277d2d9bde19755625bdf9adbf4d7c372e3a35a6a3957533f9194b8e037533340a14a7c371eeca10e70ba040c7d1a362c7
-
SSDEEP
3072:3A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo8o:3zIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral2/memory/2728-1-0x0000000074C90000-0x0000000074CC0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1756 2728 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2728 1456 rundll32.exe 89 PID 1456 wrote to memory of 2728 1456 rundll32.exe 89 PID 1456 wrote to memory of 2728 1456 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10c00e9f0b0bc101ec6b6ea9e2e9b2a3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10c00e9f0b0bc101ec6b6ea9e2e9b2a3.dll,#12⤵PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 6923⤵
- Program crash
PID:1756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2728 -ip 27281⤵PID:3864