Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 03:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4e13cab3b2f495f467d5c9a64aafca6.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
c4e13cab3b2f495f467d5c9a64aafca6.dll
-
Size
188KB
-
MD5
c4e13cab3b2f495f467d5c9a64aafca6
-
SHA1
708f9a2729e0ceac28eed1c498eeb2d133776a3d
-
SHA256
0cdf7b666a8ca69db0046b0cd0a03902f85d6fea29a63cbe22c9dc92f4dc6265
-
SHA512
e9107a4f0e631535d64f5c11c770ff0bc081f2f36f1278f57a6449450350f69a81050b2a2df796caf54abf2a84b96e909369562289d7f023fe38c7236219c713
-
SSDEEP
3072:vA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAovo:vzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/1808-0-0x0000000074940000-0x0000000074970000-memory.dmp dridex_ldr behavioral1/memory/1808-2-0x0000000074940000-0x0000000074970000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2500 1808 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 2180 wrote to memory of 1808 2180 rundll32.exe 28 PID 1808 wrote to memory of 2500 1808 rundll32.exe 29 PID 1808 wrote to memory of 2500 1808 rundll32.exe 29 PID 1808 wrote to memory of 2500 1808 rundll32.exe 29 PID 1808 wrote to memory of 2500 1808 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4e13cab3b2f495f467d5c9a64aafca6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4e13cab3b2f495f467d5c9a64aafca6.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 3083⤵
- Program crash
PID:2500
-
-