Resubmissions
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
14-07-2020 05:12
Static task
static1
Behavioral task
behavioral1
Sample
XmlLite.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
XmlLite.dll
-
Size
972KB
-
MD5
a55f44aacfb66d6494db7b94f6a170e4
-
SHA1
f181f65e6c147b046ba6dfaffa89d7ec45ce674d
-
SHA256
c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e
-
SHA512
0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr -
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
pid Process 2192 irftp.exe 2592 wusa.exe 2900 BitLockerWizard.exe -
Loads dropped DLL 3 IoCs
pid Process 2192 irftp.exe 2592 wusa.exe 2900 BitLockerWizard.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ho1wcjySrO\\wusa.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BitLockerWizard.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA irftp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wusa.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 624 IoCs
pid Process 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2192 irftp.exe 2192 irftp.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2592 wusa.exe 2592 wusa.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2900 BitLockerWizard.exe 2900 BitLockerWizard.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3012 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2176 3012 Process not Found 72 PID 3012 wrote to memory of 2176 3012 Process not Found 72 PID 3012 wrote to memory of 2192 3012 Process not Found 73 PID 3012 wrote to memory of 2192 3012 Process not Found 73 PID 3012 wrote to memory of 2492 3012 Process not Found 74 PID 3012 wrote to memory of 2492 3012 Process not Found 74 PID 3012 wrote to memory of 2592 3012 Process not Found 75 PID 3012 wrote to memory of 2592 3012 Process not Found 75 PID 3012 wrote to memory of 2880 3012 Process not Found 76 PID 3012 wrote to memory of 2880 3012 Process not Found 76 PID 3012 wrote to memory of 2900 3012 Process not Found 77 PID 3012 wrote to memory of 2900 3012 Process not Found 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XmlLite.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵PID:2176
-
C:\Users\Admin\AppData\Local\DgPNn0\irftp.exeC:\Users\Admin\AppData\Local\DgPNn0\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵PID:2492
-
C:\Users\Admin\AppData\Local\hCDPK5f\wusa.exeC:\Users\Admin\AppData\Local\hCDPK5f\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2592
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵PID:2880
-
C:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exeC:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2900