Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 05:27
Static task
static1
Behavioral task
behavioral1
Sample
1691ee8af1589da646535b0368f98b40N.dll
Resource
win7-20240704-en
General
-
Target
1691ee8af1589da646535b0368f98b40N.dll
-
Size
179KB
-
MD5
1691ee8af1589da646535b0368f98b40
-
SHA1
aac651979e1bcec156fa0987d39fdaca80b87d72
-
SHA256
39a70e2aadc823ff8fb1fe41f4885599e81c2c869e08bcf23efafc7efb97b59d
-
SHA512
af70b64ef0b10cf9eeae17b706dcf3606200deb9a3d6aaa3828464bc963a875a0df7756c3129df97f7ca6e681fedc5652573a397e83a08eff7078a24fe5217b8
-
SSDEEP
3072:wuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJj:czWxkOP4p2EesvcDi6DOHPJ0
Malware Config
Extracted
dridex
22201
144.76.1.150:443
50.249.212.98:23399
104.168.154.79:5007
Signatures
-
resource yara_rule behavioral2/memory/2456-0-0x00000000749A0000-0x00000000749D1000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1992 2456 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4380 wrote to memory of 2456 4380 rundll32.exe 83 PID 4380 wrote to memory of 2456 4380 rundll32.exe 83 PID 4380 wrote to memory of 2456 4380 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1691ee8af1589da646535b0368f98b40N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1691ee8af1589da646535b0368f98b40N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 6363⤵
- Program crash
PID:1992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2456 -ip 24561⤵PID:4260
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.238.56.23.in-addr.arpaIN PTRResponse88.238.56.23.in-addr.arpaIN PTRa23-56-238-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
88.238.56.23.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa