Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aadb6a26bb8c691191ba90c739dec939.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
aadb6a26bb8c691191ba90c739dec939.dll
-
Size
188KB
-
MD5
aadb6a26bb8c691191ba90c739dec939
-
SHA1
a168dd6c7ad408b8a3ba71fcc6979fad49a22833
-
SHA256
c6d45d76e4500258e7d3fc6e8b69cfa4b0ef6495ddb46569b6398baa9f54ad16
-
SHA512
bcaa1ffc316ec9d6e86d0b99328fe00097cf0bacd14ec9d8e337498dc321179f2de6a41b9a180227cbe01748504cffa669ef5c54155a2ee621bf124f0a089486
-
SSDEEP
3072:GA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo1o:GzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2504-0-0x00000000752A0000-0x00000000752D0000-memory.dmp dridex_ldr behavioral1/memory/2504-2-0x00000000752A0000-0x00000000752D0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2640 2504 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2600 wrote to memory of 2504 2600 rundll32.exe 28 PID 2504 wrote to memory of 2640 2504 rundll32.exe 29 PID 2504 wrote to memory of 2640 2504 rundll32.exe 29 PID 2504 wrote to memory of 2640 2504 rundll32.exe 29 PID 2504 wrote to memory of 2640 2504 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aadb6a26bb8c691191ba90c739dec939.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aadb6a26bb8c691191ba90c739dec939.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 3083⤵
- Program crash
PID:2640
-
-