Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 12:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8dc9fe6f52c4f5f165f6a49913fe554.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
d8dc9fe6f52c4f5f165f6a49913fe554.dll
-
Size
188KB
-
MD5
d8dc9fe6f52c4f5f165f6a49913fe554
-
SHA1
5c42471bc4bf955ccfde8fcc7bc85d8fd51657a1
-
SHA256
856c4a0185bedb970e1116e83c4a0384ac41b1f6f692974579fbc63cc669b769
-
SHA512
3b9bf283a4faa6287457db738217c1af08b1687fdccd8c4593a4194323bf42ca278a18c623aae98442e485c293c1285b013c97a221c1116fd179d876df35dcae
-
SSDEEP
3072:/A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAojo:/zIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2188-0-0x0000000074990000-0x00000000749C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2784 2188 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 2188 1928 rundll32.exe rundll32.exe PID 2188 wrote to memory of 2784 2188 rundll32.exe WerFault.exe PID 2188 wrote to memory of 2784 2188 rundll32.exe WerFault.exe PID 2188 wrote to memory of 2784 2188 rundll32.exe WerFault.exe PID 2188 wrote to memory of 2784 2188 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8dc9fe6f52c4f5f165f6a49913fe554.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8dc9fe6f52c4f5f165f6a49913fe554.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 3003⤵
- Program crash
PID:2784