Resubmissions
Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
14-07-2020 05:12
Static task
static1
Behavioral task
behavioral1
Sample
VERSION.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
VERSION.dll
-
Size
972KB
-
MD5
07b6339df2acddd30de436999071fc4b
-
SHA1
2550d842be80b811afa930384c0db06908bc1011
-
SHA256
4ed7566f8b70e42f52615a3c06512b10c6b3feef33627a82cdef1f054aa4cc75
-
SHA512
ef2b54af64064f6fdd4224b3b283e9e6b76d8d92a01d6e9044d016bbf2b2b295f4ed66a48d389a08ed4fc3d72a843f7ed32f43f91280658f897b2ad078324586
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr -
resource yara_rule behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
pid Process 3696 mmc.exe 3780 ddodiag.exe 3032 wlrmdr.exe -
Loads dropped DLL 3 IoCs
pid Process 3696 mmc.exe 3780 ddodiag.exe 3032 wlrmdr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\FtAtBSu\\ddodiag.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mmc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ddodiag.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wlrmdr.exe -
JavaScript code in executable 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ad7b-4.dat js behavioral2/files/0x000100000001ad7b-5.dat js -
Suspicious behavior: EnumeratesProcesses 636 IoCs
pid Process 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3696 mmc.exe 3696 mmc.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3780 ddodiag.exe 3780 ddodiag.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3032 wlrmdr.exe 3032 wlrmdr.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found Token: SeShutdownPrivilege 3012 Process not Found Token: SeCreatePagefilePrivilege 3012 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3012 wrote to memory of 3532 3012 Process not Found 71 PID 3012 wrote to memory of 3532 3012 Process not Found 71 PID 3012 wrote to memory of 3696 3012 Process not Found 72 PID 3012 wrote to memory of 3696 3012 Process not Found 72 PID 3012 wrote to memory of 4036 3012 Process not Found 73 PID 3012 wrote to memory of 4036 3012 Process not Found 73 PID 3012 wrote to memory of 3780 3012 Process not Found 74 PID 3012 wrote to memory of 3780 3012 Process not Found 74 PID 3012 wrote to memory of 3612 3012 Process not Found 75 PID 3012 wrote to memory of 3612 3012 Process not Found 75 PID 3012 wrote to memory of 3032 3012 Process not Found 76 PID 3012 wrote to memory of 3032 3012 Process not Found 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VERSION.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2016
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵PID:3532
-
C:\Users\Admin\AppData\Local\GSesk8\mmc.exeC:\Users\Admin\AppData\Local\GSesk8\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3696
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵PID:4036
-
C:\Users\Admin\AppData\Local\Ny5xA94\ddodiag.exeC:\Users\Admin\AppData\Local\Ny5xA94\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3780
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵PID:3612
-
C:\Users\Admin\AppData\Local\2eI6D\wlrmdr.exeC:\Users\Admin\AppData\Local\2eI6D\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3032