Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c422d4295343abe925c625ac3fd78be6.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
c422d4295343abe925c625ac3fd78be6.dll
-
Size
188KB
-
MD5
c422d4295343abe925c625ac3fd78be6
-
SHA1
e9ccb3c8bac68bc3416ec21782600575bfca6c37
-
SHA256
2ee3d16437e6d8347cc38f1a202b2f16223b6a8c0c9cd3eb27ea49aae963a8f8
-
SHA512
56c27ca5371a341cc6c69761583b71c68a70c270f17a98ec274f25cb5aef7ae8a5911aa23b88be388ac95af8c99d7843189faa4a52e0679c1aa15465a48ecfc3
-
SSDEEP
3072:xA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoGo:xzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral2/memory/1220-0-0x00000000750C0000-0x00000000750F0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 5092 1220 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1220 1716 rundll32.exe 82 PID 1716 wrote to memory of 1220 1716 rundll32.exe 82 PID 1716 wrote to memory of 1220 1716 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c422d4295343abe925c625ac3fd78be6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c422d4295343abe925c625ac3fd78be6.dll,#12⤵PID:1220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 6923⤵
- Program crash
PID:5092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1220 -ip 12201⤵PID:5044