Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 08:11
Static task
static1
Behavioral task
behavioral1
Sample
e7c5dd664f4e33effac80b406b6e6fe0N.dll
Resource
win7-20240903-en
General
-
Target
e7c5dd664f4e33effac80b406b6e6fe0N.dll
-
Size
188KB
-
MD5
e7c5dd664f4e33effac80b406b6e6fe0
-
SHA1
f08c30da985b11739ee245348a7ad904c65da63c
-
SHA256
26d97ab5294bb301c0efc87e6b385c7cb89e39f43234dde03bbbdc5f89ccc90f
-
SHA512
686cba4544f80bee9c5839cd32ff1002648ab124bae4e085165fd33e7f18754b4f845f3c0cd9ea0f323c349057cf4c1b058c8666d70993db98a0878c79eefbf4
-
SSDEEP
3072:PteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:Xq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
resource yara_rule behavioral2/memory/1100-0-0x0000000074E10000-0x0000000074E40000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4464 1100 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2592 wrote to memory of 1100 2592 rundll32.exe 83 PID 2592 wrote to memory of 1100 2592 rundll32.exe 83 PID 2592 wrote to memory of 1100 2592 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7c5dd664f4e33effac80b406b6e6fe0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e7c5dd664f4e33effac80b406b6e6fe0N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 6963⤵
- Program crash
PID:4464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1100 -ip 11001⤵PID:5048
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request59.238.56.23.in-addr.arpaIN PTRResponse59.238.56.23.in-addr.arpaIN PTRa23-56-238-59deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
59.238.56.23.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa