Analysis
-
max time kernel
71s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 18:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
998493323f37f0355777b2325f603ee8956abd829cbf3f460e3c75e5a3441bad.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
998493323f37f0355777b2325f603ee8956abd829cbf3f460e3c75e5a3441bad.dll
-
Size
180KB
-
MD5
2f478113bddc5e6430353d43d16c2bb0
-
SHA1
f0a224dc08e93b576db5039f7bdfcb00be8f1e43
-
SHA256
998493323f37f0355777b2325f603ee8956abd829cbf3f460e3c75e5a3441bad
-
SHA512
f3c65644ae8cfc3731b4c948e5a65e4a672f874b628dc3940601f3aefdd7afd7198b9f33e7bbc2c4f8741988c8a18389baf2bc86ab7c43e803dcd83000d5f73d
-
SSDEEP
3072:M3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:YUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
Family
dridex
Botnet
111
C2
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2960-0-0x00000000750D0000-0x00000000750FE000-memory.dmp dridex_ldr behavioral1/memory/2960-2-0x00000000750D0000-0x00000000750FE000-memory.dmp dridex_ldr -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe PID 2876 wrote to memory of 2960 2876 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\998493323f37f0355777b2325f603ee8956abd829cbf3f460e3c75e5a3441bad.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\998493323f37f0355777b2325f603ee8956abd829cbf3f460e3c75e5a3441bad.dll,#12⤵