Resubmissions
Analysis
-
max time kernel
151s -
max time network
67s -
platform
windows7_x64 -
resource
win7 -
submitted
14-07-2020 05:12
Static task
static1
Behavioral task
behavioral1
Sample
XmlLite.dll
Resource
win7
General
-
Target
XmlLite.dll
-
Size
972KB
-
MD5
a55f44aacfb66d6494db7b94f6a170e4
-
SHA1
f181f65e6c147b046ba6dfaffa89d7ec45ce674d
-
SHA256
c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e
-
SHA512
0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1300-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr -
Processes:
resource yara_rule behavioral1/memory/1300-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
Processes:
irftp.exetabcal.exeslui.exepid Process 1048 irftp.exe 1696 tabcal.exe 1852 slui.exe -
Loads dropped DLL 7 IoCs
Processes:
irftp.exetabcal.exeslui.exepid Process 1300 1048 irftp.exe 1300 1696 tabcal.exe 1300 1852 slui.exe 1300 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vpubrqhrepmzp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\DY3X\\tabcal.exe" -
Processes:
rundll32.exeirftp.exetabcal.exeslui.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA irftp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tabcal.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA slui.exe -
Suspicious behavior: EnumeratesProcesses 606 IoCs
Processes:
rundll32.exepid Process 112 rundll32.exe 112 rundll32.exe 112 rundll32.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1048 irftp.exe 1048 irftp.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1696 tabcal.exe 1696 tabcal.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1852 slui.exe 1852 slui.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
pid Process 1300 1300 1300 1300 1300 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid Process 1300 1300 1300 1300 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid Process 1300 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid Process procid_target PID 1300 wrote to memory of 1652 1300 24 PID 1300 wrote to memory of 1652 1300 24 PID 1300 wrote to memory of 1652 1300 24 PID 1300 wrote to memory of 1048 1300 25 PID 1300 wrote to memory of 1048 1300 25 PID 1300 wrote to memory of 1048 1300 25 PID 1300 wrote to memory of 1496 1300 26 PID 1300 wrote to memory of 1496 1300 26 PID 1300 wrote to memory of 1496 1300 26 PID 1300 wrote to memory of 1696 1300 27 PID 1300 wrote to memory of 1696 1300 27 PID 1300 wrote to memory of 1696 1300 27 PID 1300 wrote to memory of 1824 1300 28 PID 1300 wrote to memory of 1824 1300 28 PID 1300 wrote to memory of 1824 1300 28 PID 1300 wrote to memory of 1852 1300 29 PID 1300 wrote to memory of 1852 1300 29 PID 1300 wrote to memory of 1852 1300 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XmlLite.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:112
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵PID:1652
-
C:\Users\Admin\AppData\Local\vMownU\irftp.exeC:\Users\Admin\AppData\Local\vMownU\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1048
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵PID:1496
-
C:\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exeC:\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1696
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵PID:1824
-
C:\Users\Admin\AppData\Local\SdT2Mb9m\slui.exeC:\Users\Admin\AppData\Local\SdT2Mb9m\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1852
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
05c640b7a7666891689846bfd51ee772
SHA12dff37e945c6e6c372ebf8aa9243865d6b225d84
SHA256063a51621277679148c8aac630ca3a375dd23fd8b4138b3ae29593040d512a36
SHA51271e5917d6910b69c5e6e6e7d33d0ff9c56fc32212ae47d36a6e2f5a33cbb1fbeb1c97779617d4a9398dc3520ca7430191f548ebc7304c1f07d918d8877d78d96
-
MD5
c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
MD5
fc6375d824a89447d41c5e3de640d817
SHA18478c2a3cc290aea7ebc1990c11adf5ea1de2c92
SHA2560a0ef1a0811d76b56416054f317be266a6fee0f0cdd3d91bb1dd8d184afbe7fb
SHA5127484d3e2c6d7288b12a1e313a53bc4234cee9aa54e44b9173ab6dbbf93b59ab07c7dee36769d6f0046fd7823be9531d3b4e7db69e029f2e7bd5ae5a51c6ca33f
-
MD5
98e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
MD5
e1e01f416a7ab31d134e985a5f4f0006
SHA11ad485eeeed84b093842ddb7c9a55cff3f4868d9
SHA256e3a67b6c96181af20a7d6fdfed80b48619a368e6b25f7a721ff60082799a2175
SHA512742a206a631f2de4434b9b93a7f608c060d81f1a8b26659e128681f6544ac69fc47f397f69295bbcd55c8a5f258f993db798f55ddd129b1ad40f6d28cf5f170a
-
MD5
0cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
MD5
05c640b7a7666891689846bfd51ee772
SHA12dff37e945c6e6c372ebf8aa9243865d6b225d84
SHA256063a51621277679148c8aac630ca3a375dd23fd8b4138b3ae29593040d512a36
SHA51271e5917d6910b69c5e6e6e7d33d0ff9c56fc32212ae47d36a6e2f5a33cbb1fbeb1c97779617d4a9398dc3520ca7430191f548ebc7304c1f07d918d8877d78d96
-
MD5
c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
MD5
fc6375d824a89447d41c5e3de640d817
SHA18478c2a3cc290aea7ebc1990c11adf5ea1de2c92
SHA2560a0ef1a0811d76b56416054f317be266a6fee0f0cdd3d91bb1dd8d184afbe7fb
SHA5127484d3e2c6d7288b12a1e313a53bc4234cee9aa54e44b9173ab6dbbf93b59ab07c7dee36769d6f0046fd7823be9531d3b4e7db69e029f2e7bd5ae5a51c6ca33f
-
MD5
98e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
MD5
e1e01f416a7ab31d134e985a5f4f0006
SHA11ad485eeeed84b093842ddb7c9a55cff3f4868d9
SHA256e3a67b6c96181af20a7d6fdfed80b48619a368e6b25f7a721ff60082799a2175
SHA512742a206a631f2de4434b9b93a7f608c060d81f1a8b26659e128681f6544ac69fc47f397f69295bbcd55c8a5f258f993db798f55ddd129b1ad40f6d28cf5f170a
-
MD5
0cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
MD5
c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c