Resubmissions
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10_x64 -
resource
win10 -
submitted
14-07-2020 11:19
Static task
static1
Behavioral task
behavioral1
Sample
VERSION.dll
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
VERSION.dll
-
Size
972KB
-
MD5
07b6339df2acddd30de436999071fc4b
-
SHA1
2550d842be80b811afa930384c0db06908bc1011
-
SHA256
4ed7566f8b70e42f52615a3c06512b10c6b3feef33627a82cdef1f054aa4cc75
-
SHA512
ef2b54af64064f6fdd4224b3b283e9e6b76d8d92a01d6e9044d016bbf2b2b295f4ed66a48d389a08ed4fc3d72a843f7ed32f43f91280658f897b2ad078324586
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2988-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr -
resource yara_rule behavioral2/memory/2988-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
pid Process 3188 sigverif.exe 1708 dpapimig.exe 2980 wscript.exe -
Loads dropped DLL 3 IoCs
pid Process 3188 sigverif.exe 1708 dpapimig.exe 2980 wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jqhowtig = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\aZYfS9\\dpapimig.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sigverif.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dpapimig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wscript.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 624 IoCs
pid Process 3612 rundll32.exe 3612 rundll32.exe 3612 rundll32.exe 3612 rundll32.exe 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 3188 sigverif.exe 3188 sigverif.exe 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 1708 dpapimig.exe 1708 dpapimig.exe 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2980 wscript.exe 2980 wscript.exe 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found 2988 Process not Found -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found Token: SeShutdownPrivilege 2988 Process not Found Token: SeCreatePagefilePrivilege 2988 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2988 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3352 2988 Process not Found 71 PID 2988 wrote to memory of 3352 2988 Process not Found 71 PID 2988 wrote to memory of 3188 2988 Process not Found 72 PID 2988 wrote to memory of 3188 2988 Process not Found 72 PID 2988 wrote to memory of 344 2988 Process not Found 73 PID 2988 wrote to memory of 344 2988 Process not Found 73 PID 2988 wrote to memory of 1708 2988 Process not Found 74 PID 2988 wrote to memory of 1708 2988 Process not Found 74 PID 2988 wrote to memory of 1004 2988 Process not Found 75 PID 2988 wrote to memory of 1004 2988 Process not Found 75 PID 2988 wrote to memory of 2980 2988 Process not Found 76 PID 2988 wrote to memory of 2980 2988 Process not Found 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VERSION.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵PID:3352
-
C:\Users\Admin\AppData\Local\mIrV\sigverif.exeC:\Users\Admin\AppData\Local\mIrV\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3188
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵PID:344
-
C:\Users\Admin\AppData\Local\3vnbBUA\dpapimig.exeC:\Users\Admin\AppData\Local\3vnbBUA\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1708
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵PID:1004
-
C:\Users\Admin\AppData\Local\K4r\wscript.exeC:\Users\Admin\AppData\Local\K4r\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2980