Analysis
-
max time kernel
54s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 17:39
Static task
static1
Behavioral task
behavioral1
Sample
dd8412e4b7176887557fa52d8e851e2c373130bfed0da6c8eb267979ddc796a2.dll
Resource
win7-20240903-en
General
-
Target
dd8412e4b7176887557fa52d8e851e2c373130bfed0da6c8eb267979ddc796a2.dll
-
Size
180KB
-
MD5
7749e0ff61a8bef3dec048998e838ede
-
SHA1
998fe754710b0aa0deb9729bfb2be1d0e3010243
-
SHA256
dd8412e4b7176887557fa52d8e851e2c373130bfed0da6c8eb267979ddc796a2
-
SHA512
f60d5dcfe25b8b17c78b8cad19044fbdf6cdd1da97eecbf9151d31c33d6999d92f5d9cb85619086e9b8b3e7646b56a799a471122b7f799a7e75000fba1dd5264
-
SSDEEP
3072:x3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:ZUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
dridex
111
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
Signatures
-
resource yara_rule behavioral1/memory/1952-0-0x0000000074640000-0x000000007466E000-memory.dmp dridex_ldr behavioral1/memory/1952-2-0x0000000074640000-0x000000007466E000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30 PID 1992 wrote to memory of 1952 1992 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8412e4b7176887557fa52d8e851e2c373130bfed0da6c8eb267979ddc796a2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8412e4b7176887557fa52d8e851e2c373130bfed0da6c8eb267979ddc796a2.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1952
-