Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 06:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5697b0fe657921264f93e7db3d7b6f6.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
d5697b0fe657921264f93e7db3d7b6f6.dll
-
Size
188KB
-
MD5
d5697b0fe657921264f93e7db3d7b6f6
-
SHA1
5d11a0edb9c9abadcb657ad13f21f367f6f5b438
-
SHA256
8bbd38d75965492de8bd3ca006b634b52ca34dcf11354fc78396ca0edbc9d5f8
-
SHA512
6199e8c7ae1dbea17058757f0dfaabdc2d005dd330b61b3b71b396bacdde086101c809ff5ba5e6817bc5496417dc51475af34be2ef602f8d0fda3ee72868a7d6
-
SSDEEP
3072:hA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAolo:hzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral2/memory/4452-0-0x0000000074F10000-0x0000000074F40000-memory.dmp dridex_ldr behavioral2/memory/4452-2-0x0000000074F10000-0x0000000074F40000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 3100 4452 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5096 wrote to memory of 4452 5096 rundll32.exe 88 PID 5096 wrote to memory of 4452 5096 rundll32.exe 88 PID 5096 wrote to memory of 4452 5096 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5697b0fe657921264f93e7db3d7b6f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5697b0fe657921264f93e7db3d7b6f6.dll,#12⤵PID:4452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6923⤵
- Program crash
PID:3100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4452 -ip 44521⤵PID:4928