Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 18:07
Static task
static1
Behavioral task
behavioral1
Sample
0179a858ea713a30cced2f0578157f358c5ce56375f6eff33ba323e0dd4448a9.dll
Resource
win7-20240729-en
General
-
Target
0179a858ea713a30cced2f0578157f358c5ce56375f6eff33ba323e0dd4448a9.dll
-
Size
184KB
-
MD5
7d68a29f7245ac38989b70df90e8867b
-
SHA1
43c4f3f90076b28b15c18b0be3d66f0600b72580
-
SHA256
0179a858ea713a30cced2f0578157f358c5ce56375f6eff33ba323e0dd4448a9
-
SHA512
cdafc7658797a6a3459baa0b48ed7290d5efc1731279dbb8566cdc9f230532ddbf4d6b958ab54c91a36f380e0e0c5a3ffb8d08b0d4bb060347a03f0147948203
-
SSDEEP
3072:FJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8JEa//2uFrSc:ufYOX+wTScR/Xzku9LVwDuG
Malware Config
Extracted
dridex
22201
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
resource yara_rule behavioral1/memory/2508-0-0x0000000074C90000-0x0000000074CBF000-memory.dmp dridex_ldr behavioral1/memory/2508-1-0x0000000074C90000-0x0000000074CBF000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1248 2508 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 1924 wrote to memory of 2508 1924 rundll32.exe 31 PID 2508 wrote to memory of 1248 2508 rundll32.exe 32 PID 2508 wrote to memory of 1248 2508 rundll32.exe 32 PID 2508 wrote to memory of 1248 2508 rundll32.exe 32 PID 2508 wrote to memory of 1248 2508 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0179a858ea713a30cced2f0578157f358c5ce56375f6eff33ba323e0dd4448a9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0179a858ea713a30cced2f0578157f358c5ce56375f6eff33ba323e0dd4448a9.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 2203⤵
- Program crash
PID:1248
-
-