Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da17d1c6405f452d06624753f9e7879e.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
da17d1c6405f452d06624753f9e7879e.dll
-
Size
188KB
-
MD5
da17d1c6405f452d06624753f9e7879e
-
SHA1
2b7602b83b7f0fdf2eac421c9b18ed2867563fe9
-
SHA256
f832addd592e488b2f44608f494257ad10dba192c31f638e5f4b89a30aeacb5d
-
SHA512
9374610c752660fdf510db30dbf19b3810632004830ce501b944e0048560fdaade64cd71f755d5c8176de0017573d4a281a08fdee94fde7934294e77fcc080fe
-
SSDEEP
3072:qA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoQo:qzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3684-0-0x0000000075260000-0x0000000075290000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2744 3684 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3472 wrote to memory of 3684 3472 rundll32.exe rundll32.exe PID 3472 wrote to memory of 3684 3472 rundll32.exe rundll32.exe PID 3472 wrote to memory of 3684 3472 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da17d1c6405f452d06624753f9e7879e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da17d1c6405f452d06624753f9e7879e.dll,#12⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 6883⤵
- Program crash
PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3684 -ip 36841⤵PID:3908