Analysis
-
max time kernel
114s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0e4683bd1e150ef7d1c972da42a3ae6.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
b0e4683bd1e150ef7d1c972da42a3ae6.dll
-
Size
188KB
-
MD5
b0e4683bd1e150ef7d1c972da42a3ae6
-
SHA1
dc0c63af8df262be1258b5cb6b735da83c9462c4
-
SHA256
ebf75f9a4ef757c673ebc72da69d65ff957cef91926be1f957fd75435282fc1a
-
SHA512
c5b9b02fbcdf7e041cc99eda80420179b2c320a56b3a9dd86b0959d8b0a2d64458fb55fb1782bc271d972cd2355a4f15ed6d68a5fb2ed60f456ec5fce6bdd357
-
SSDEEP
3072:qA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoXo:qzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral2/memory/1944-0-0x00000000758F0000-0x0000000075920000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2492 1944 WerFault.exe 93 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3396 wrote to memory of 1944 3396 rundll32.exe 93 PID 3396 wrote to memory of 1944 3396 rundll32.exe 93 PID 3396 wrote to memory of 1944 3396 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e4683bd1e150ef7d1c972da42a3ae6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0e4683bd1e150ef7d1c972da42a3ae6.dll,#12⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 6883⤵
- Program crash
PID:2492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1944 -ip 19441⤵PID:4120
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:81⤵PID:4008