Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfea8f212cb8e673279674d9662d064f.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
dfea8f212cb8e673279674d9662d064f.dll
-
Size
188KB
-
MD5
dfea8f212cb8e673279674d9662d064f
-
SHA1
509e867bf4e9d62b94c563771d8588bb4d43e4b3
-
SHA256
20021dec8c17fa576620524f1eb08a3a80ccbb29b52b2f1644b995360164531d
-
SHA512
c4aa02ff0f12998842141cb8111695e37d209804c33bb9e0fd57c41cfc62cefa55f7bbd1f0174acf394869f64938f7f7799e0bcc5bb75da633ddfc87581c2216
-
SSDEEP
3072:m1A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoqo:4zIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/800-0-0x0000000075530000-0x0000000075560000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 972 800 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 448 wrote to memory of 800 448 rundll32.exe rundll32.exe PID 448 wrote to memory of 800 448 rundll32.exe rundll32.exe PID 448 wrote to memory of 800 448 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dfea8f212cb8e673279674d9662d064f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dfea8f212cb8e673279674d9662d064f.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 6883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 800 -ip 8001⤵