Resubmissions
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
14-07-2020 05:12
Static task
static1
Behavioral task
behavioral1
Sample
XmlLite.dll
Resource
win7
General
-
Target
XmlLite.dll
-
Size
972KB
-
MD5
a55f44aacfb66d6494db7b94f6a170e4
-
SHA1
f181f65e6c147b046ba6dfaffa89d7ec45ce674d
-
SHA256
c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e
-
SHA512
0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr -
Processes:
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
Processes:
irftp.exewusa.exeBitLockerWizard.exepid Process 2192 irftp.exe 2592 wusa.exe 2900 BitLockerWizard.exe -
Loads dropped DLL 3 IoCs
Processes:
irftp.exewusa.exeBitLockerWizard.exepid Process 2192 irftp.exe 2592 wusa.exe 2900 BitLockerWizard.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ho1wcjySrO\\wusa.exe" -
Processes:
BitLockerWizard.exerundll32.exeirftp.exewusa.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BitLockerWizard.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA irftp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wusa.exe -
Modifies registry class 2 IoCs
Processes:
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Suspicious behavior: EnumeratesProcesses 624 IoCs
Processes:
rundll32.exepid Process 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 2192 irftp.exe 2192 irftp.exe 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 2592 wusa.exe 2592 wusa.exe 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 2900 BitLockerWizard.exe 2900 BitLockerWizard.exe 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
description pid Process Token: SeShutdownPrivilege 3012 Token: SeCreatePagefilePrivilege 3012 Token: SeShutdownPrivilege 3012 Token: SeCreatePagefilePrivilege 3012 Token: SeShutdownPrivilege 3012 Token: SeCreatePagefilePrivilege 3012 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
pid Process 3012 -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
pid Process 3012 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid Process procid_target PID 3012 wrote to memory of 2176 3012 72 PID 3012 wrote to memory of 2176 3012 72 PID 3012 wrote to memory of 2192 3012 73 PID 3012 wrote to memory of 2192 3012 73 PID 3012 wrote to memory of 2492 3012 74 PID 3012 wrote to memory of 2492 3012 74 PID 3012 wrote to memory of 2592 3012 75 PID 3012 wrote to memory of 2592 3012 75 PID 3012 wrote to memory of 2880 3012 76 PID 3012 wrote to memory of 2880 3012 76 PID 3012 wrote to memory of 2900 3012 77 PID 3012 wrote to memory of 2900 3012 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XmlLite.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵PID:2176
-
C:\Users\Admin\AppData\Local\DgPNn0\irftp.exeC:\Users\Admin\AppData\Local\DgPNn0\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵PID:2492
-
C:\Users\Admin\AppData\Local\hCDPK5f\wusa.exeC:\Users\Admin\AppData\Local\hCDPK5f\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2592
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵PID:2880
-
C:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exeC:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f87bea2be4b4d8fd46917e39a6793440
SHA16ca9b0aabae865a97ff0638fd79fd2abfe967b99
SHA2561529356aef83f46b1e93e551edcc7d65d8e1e74e0f4d22b210e915f2e8bffc3a
SHA5129e2f71bcf862a96ffce42663eb38a656aa4d0f79cfe70e6cef43cd4a4b1795529517195f423c03455830ab8a9ea3f1efa906321c4f2c43337a8e086c13ddc2c9
-
MD5
dbc1bc119e305f66dabe98d43e40113a
SHA176cc827689d52f2aeb3acc679e6b1a69f7674052
SHA256cb2bf82f7d678a376a9609048518b1bcc40c41a0d689248753cbd7a7f3744468
SHA5121bdb81ee7c2505a94d224390c0ae84262986f11b4d86acc0259a483f7a264aaebf2744068504c4200b98922f713ef3f0f3e1dbb8aed50f9fb625dc458585b415
-
MD5
cb4b3823ffd9acbae99f816e868a6497
SHA1e21d7faf3fdfb5793e05d84621839b7fb09e3c2b
SHA2566052eaa663cee42fcd251888754da18545ac06388e73d22a56472213ae49e443
SHA51244a779ad39c748a26242814b8888c3b897b2225d3218f7513e86e984755a191f8600402576e5e26d6f0d3a7f5b5186aa04fd9aebd27cf8c26d67687fa8e08c9e
-
MD5
808ee0ed0ebebe64832bf7fbe034d23a
SHA130d23c3e8f4705d2e720deecfc7544d78a2857a5
SHA25644a7409999c9b75e6473c8f4395a1335fd65e002bcfea94cf8af2734c0993f9e
SHA5128356ac02e92407e5061db4e5945c870f8f69839d208e504e739c28b87bea7c049fdd3dbc9dd62b659d1caee82a028776ae0824182f8329010cf9e521259a8e4c
-
MD5
c213e950a565d1fbe302961f029dddc8
SHA1edeaf01a3dbfdfca54a5e25c121d9645dd75bf86
SHA256f90e755a99ce576c643b751d4f87f4b301d0bf7264f74023225b9b8b7f2e302d
SHA512081f5ee07b6ffae41e494a13c720a8fb92a05c68b1f72c0bc6422050fabc2a433b84f6a3991defa4bfc9d5a721fb8cd83927613d4423f918cf8e57427e825fb0
-
MD5
76a4d9d0ec9a27d3799a4744ae5de374
SHA1aac25064911f27c3c26b018cd70dbd8e69c52e61
SHA2560efaa23b460712e3a3432e6255712ad8c3c34a337b0a84f41e38984b427bf10d
SHA51236c64ab19159f77bf2604b561cd67faf65973a2c98fbe0a8ccfa8658ed0162da943552b3274a48b88ade3811c20187b9a53e6abaa448d0e7d458c42cf817efc9
-
MD5
f87bea2be4b4d8fd46917e39a6793440
SHA16ca9b0aabae865a97ff0638fd79fd2abfe967b99
SHA2561529356aef83f46b1e93e551edcc7d65d8e1e74e0f4d22b210e915f2e8bffc3a
SHA5129e2f71bcf862a96ffce42663eb38a656aa4d0f79cfe70e6cef43cd4a4b1795529517195f423c03455830ab8a9ea3f1efa906321c4f2c43337a8e086c13ddc2c9
-
MD5
cb4b3823ffd9acbae99f816e868a6497
SHA1e21d7faf3fdfb5793e05d84621839b7fb09e3c2b
SHA2566052eaa663cee42fcd251888754da18545ac06388e73d22a56472213ae49e443
SHA51244a779ad39c748a26242814b8888c3b897b2225d3218f7513e86e984755a191f8600402576e5e26d6f0d3a7f5b5186aa04fd9aebd27cf8c26d67687fa8e08c9e
-
MD5
76a4d9d0ec9a27d3799a4744ae5de374
SHA1aac25064911f27c3c26b018cd70dbd8e69c52e61
SHA2560efaa23b460712e3a3432e6255712ad8c3c34a337b0a84f41e38984b427bf10d
SHA51236c64ab19159f77bf2604b561cd67faf65973a2c98fbe0a8ccfa8658ed0162da943552b3274a48b88ade3811c20187b9a53e6abaa448d0e7d458c42cf817efc9