Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 17:41
Static task
static1
Behavioral task
behavioral1
Sample
5cb5e74d0443c75300a85955590e52a0N.dll
Resource
win7-20240729-en
General
-
Target
5cb5e74d0443c75300a85955590e52a0N.dll
-
Size
184KB
-
MD5
5cb5e74d0443c75300a85955590e52a0
-
SHA1
2d640a69f09373a3bbf3b78e29fd7f0a82ea5428
-
SHA256
d92b789235b148f705c8ec976ec93655c4b84b452b643e6d090079bcbeff90f0
-
SHA512
d099d502f5810cf1a3f20e64834d9f9d31e6f736b5e6e35867498fa9e9dbbd84f7ed6dced1b5675b24b308cc913c4d58a5c4c2f373ef1175ea5dfc67519d06a4
-
SSDEEP
3072:092qSmHOhnWpPI1ybmJIiC00PArIojHTYVBCn+rs3Ss3qLMTkrLA:09NSMOEpQ1Q3ODAr+Vw
Malware Config
Extracted
dridex
22203
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2540-0-0x0000000075440000-0x000000007546F000-memory.dmp dridex_ldr behavioral1/memory/2540-3-0x0000000075440000-0x000000007546F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3024 2540 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid Process procid_target PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2516 wrote to memory of 2540 2516 rundll32.exe 30 PID 2540 wrote to memory of 3024 2540 rundll32.exe 32 PID 2540 wrote to memory of 3024 2540 rundll32.exe 32 PID 2540 wrote to memory of 3024 2540 rundll32.exe 32 PID 2540 wrote to memory of 3024 2540 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb5e74d0443c75300a85955590e52a0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb5e74d0443c75300a85955590e52a0N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 2203⤵
- Program crash
PID:3024
-
-