Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll
Resource
win7-20240708-en
General
-
Target
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll
-
Size
180KB
-
MD5
aba3f1a29bdc0bb2471e3bbdbf04464a
-
SHA1
9a770fb31fcc3a7d60bf41ca5316e784de8aa4dd
-
SHA256
4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac
-
SHA512
369e25786976f3ccd678b0bce180e5b3b995151e783f3dd5c415c3c7b8b5f935a1c2720d3275bec3bf8b7c31a4e4a9a77fe907b0a067a3d517dac91af59408df
-
SSDEEP
3072:x3U+o/fwAUfM8+NmXhjlAZ+SWlxT5H3zipQIoZeErkxUNBG0:ZUZYxfM8+YXfq+SOxTxjipQjzk3
Malware Config
Extracted
dridex
111
94.126.8.2:443
81.2.235.131:1688
178.63.156.139:3388
Signatures
-
resource yara_rule behavioral2/memory/3920-0-0x0000000075330000-0x000000007535E000-memory.dmp dridex_ldr behavioral2/memory/3920-2-0x0000000075330000-0x000000007535E000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 732 wrote to memory of 3920 732 rundll32.exe 82 PID 732 wrote to memory of 3920 732 rundll32.exe 82 PID 732 wrote to memory of 3920 732 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4af5ec8b347bb948d8a32db7aceb56d96e295a673ca5f13aaa0a6e4558ac46ac.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3920
-