Analysis
-
max time kernel
107s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 07:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f2cd39adddbfa124c738a694e7ec4aaf02edfc28d0dbcc66571220552df3706.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
5f2cd39adddbfa124c738a694e7ec4aaf02edfc28d0dbcc66571220552df3706.dll
-
Size
180KB
-
MD5
84ba7b24631e38955aec1af2d5b0244a
-
SHA1
9f239c1b744a246579c8901e6a4d9f00ee3fd3ab
-
SHA256
5f2cd39adddbfa124c738a694e7ec4aaf02edfc28d0dbcc66571220552df3706
-
SHA512
c5ceb2c8811b6535b88543ad6c260751d5810c67f8f00da772807e34db906d52c8661708ea9f32bb5e720864c54cd69f9e00fb959ee1696b760f8b27c0356433
-
SSDEEP
3072:A3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:UUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
Family
dridex
Botnet
111
C2
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2352-0-0x0000000074AE0000-0x0000000074B0E000-memory.dmp dridex_ldr behavioral1/memory/2352-2-0x0000000074AE0000-0x0000000074B0E000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2352 3000 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cd39adddbfa124c738a694e7ec4aaf02edfc28d0dbcc66571220552df3706.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cd39adddbfa124c738a694e7ec4aaf02edfc28d0dbcc66571220552df3706.dll,#12⤵