Analysis
-
max time kernel
99s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-08-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
e4ee1ade0f1b488b5ed52927a03344a1d6f2e574f11bfb976ab2f5abd4973fae.dll
Resource
win7-20240708-en
General
-
Target
e4ee1ade0f1b488b5ed52927a03344a1d6f2e574f11bfb976ab2f5abd4973fae.dll
-
Size
180KB
-
MD5
370e241c525f5d34157713153101a411
-
SHA1
fc3fb52f6051b674af7245eeca9a760aa036fbb1
-
SHA256
e4ee1ade0f1b488b5ed52927a03344a1d6f2e574f11bfb976ab2f5abd4973fae
-
SHA512
6b249b238dc21a8edbf2ebdfcaf232483ec211b1cb4c021461630f448fea6787ed599a6cb3fa06484d1bc18de2268226c0fe5d13bbc662b95b757c4013413845
-
SSDEEP
3072:Z3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:RUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
dridex
111
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
Signatures
-
resource yara_rule behavioral1/memory/1956-0-0x0000000075270000-0x000000007529E000-memory.dmp dridex_ldr behavioral1/memory/1956-2-0x0000000075270000-0x000000007529E000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30 PID 1476 wrote to memory of 1956 1476 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4ee1ade0f1b488b5ed52927a03344a1d6f2e574f11bfb976ab2f5abd4973fae.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4ee1ade0f1b488b5ed52927a03344a1d6f2e574f11bfb976ab2f5abd4973fae.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1956
-