Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 23:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf31164a5deaee1cac41ac616c681fff.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
bf31164a5deaee1cac41ac616c681fff.dll
-
Size
184KB
-
MD5
bf31164a5deaee1cac41ac616c681fff
-
SHA1
8a1834ea5caf714f8a908e365cf64ba6f28fad95
-
SHA256
31a1e7f5ea357885fd7c9e624ead84802c3e6cc06b4b68dcf68e03ed4f308f6a
-
SHA512
e09591fd5efce81bf9a564e7b17bccb0d4a4cbdd4e8d9fa1cc7dd3deb616c337948b11f7ff57b7fd632c32ef94a13471adbec1bc4aad6354fb864e9f42e02627
-
SSDEEP
3072:Xb51A6VG71Eq55xw1jgDlO1poE2rm4coM+cxJdfhRlmg5e:Xb7tghEq3xw1j4kpP2rmLffxvfhRlme
Malware Config
Extracted
Family
dridex
Botnet
22203
C2
103.75.201.2:443
158.223.1.108:6225
165.22.28.242:4664
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3516-0-0x00000000753F0000-0x0000000075420000-memory.dmp dridex_ldr behavioral2/memory/3516-2-0x00000000753F0000-0x0000000075420000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 452 3516 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1184 wrote to memory of 3516 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 3516 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 3516 1184 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf31164a5deaee1cac41ac616c681fff.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf31164a5deaee1cac41ac616c681fff.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 5403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 35161⤵