Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0e4683bd1e150ef7d1c972da42a3ae6.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
b0e4683bd1e150ef7d1c972da42a3ae6.dll
-
Size
188KB
-
MD5
b0e4683bd1e150ef7d1c972da42a3ae6
-
SHA1
dc0c63af8df262be1258b5cb6b735da83c9462c4
-
SHA256
ebf75f9a4ef757c673ebc72da69d65ff957cef91926be1f957fd75435282fc1a
-
SHA512
c5b9b02fbcdf7e041cc99eda80420179b2c320a56b3a9dd86b0959d8b0a2d64458fb55fb1782bc271d972cd2355a4f15ed6d68a5fb2ed60f456ec5fce6bdd357
-
SSDEEP
3072:qA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:qzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/3028-0-0x0000000074E50000-0x0000000074E80000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1216 3028 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 1724 wrote to memory of 3028 1724 rundll32.exe 28 PID 3028 wrote to memory of 1216 3028 rundll32.exe 29 PID 3028 wrote to memory of 1216 3028 rundll32.exe 29 PID 3028 wrote to memory of 1216 3028 rundll32.exe 29 PID 3028 wrote to memory of 1216 3028 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e4683bd1e150ef7d1c972da42a3ae6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e4683bd1e150ef7d1c972da42a3ae6.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 3003⤵
- Program crash
PID:1216
-
-