Resubmissions
Analysis
-
max time kernel
150s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
06-08-2020 16:20
Static task
static1
Behavioral task
behavioral1
Sample
DUI70.dll
Resource
win7
General
-
Target
DUI70.dll
-
Size
1.2MB
-
MD5
ca7f847ac49ea5ec058b9455bacbb326
-
SHA1
9ea5760c8d7b2f1a479901677338e487e62aaad0
-
SHA256
1bc4755b2828092f30c53c4099d2a1b118d1a68686a82b7c11ef12c6ae93f8d4
-
SHA512
5e57d36b700f030c977213899b2d5e4421abcaf54a41ccb336067e52f779066916b58ff1c81441be8c4e69240106569d40371b6ba862e6d89cbeda1cc65d6818
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3940-0-0x0000000140000000-0x000000014008D000-memory.dmp dridex_ldr behavioral2/memory/3044-3-0x0000000140000000-0x0000000140138000-memory.dmp dridex_ldr -
Processes:
resource yara_rule behavioral2/memory/3940-0-0x0000000140000000-0x000000014008D000-memory.dmp dridex_ldr_dmod behavioral2/memory/3044-3-0x0000000140000000-0x0000000140138000-memory.dmp dridex_ldr_dmod -
Executes dropped EXE 3 IoCs
Processes:
dpapimig.exewextract.exemsra.exepid process 1392 dpapimig.exe 1664 wextract.exe 3868 msra.exe -
Loads dropped DLL 3 IoCs
Processes:
dpapimig.exewextract.exemsra.exepid process 1392 dpapimig.exe 1664 wextract.exe 3868 msra.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Axletjyt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\QLtp56Yxmrt\\wextract.exe" -
Processes:
rundll32.exedpapimig.exewextract.exemsra.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dpapimig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wextract.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msra.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Suspicious behavior: EnumeratesProcesses 633 IoCs
Processes:
rundll32.exepid process 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
pid process 3044 -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
pid process 3044 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid process target process PID 3044 wrote to memory of 1308 3044 dpapimig.exe PID 3044 wrote to memory of 1308 3044 dpapimig.exe PID 3044 wrote to memory of 1392 3044 dpapimig.exe PID 3044 wrote to memory of 1392 3044 dpapimig.exe PID 3044 wrote to memory of 1660 3044 wextract.exe PID 3044 wrote to memory of 1660 3044 wextract.exe PID 3044 wrote to memory of 1664 3044 wextract.exe PID 3044 wrote to memory of 1664 3044 wextract.exe PID 3044 wrote to memory of 3836 3044 msra.exe PID 3044 wrote to memory of 3836 3044 msra.exe PID 3044 wrote to memory of 3868 3044 msra.exe PID 3044 wrote to memory of 3868 3044 msra.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DUI70.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\jqTE\dpapimig.exeC:\Users\Admin\AppData\Local\jqTE\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\ahLBLO\wextract.exeC:\Users\Admin\AppData\Local\ahLBLO\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\f8XoiMQ\msra.exeC:\Users\Admin\AppData\Local\f8XoiMQ\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ahLBLO\VERSION.dllMD5
711aaf60b9af895c5100fb0c2f6ddf4c
SHA16ce71e953948e96c70593b404a9fcc3515095b5d
SHA256914d7ff908ced5d497260d400b71d75972f001c1467049d7f60c30fb8732acf0
SHA512ee7f713bdb1996e6d5e8412c30b8ec600b6ff0bbb8190cd23dcef45399531345362fa8acdc567bb458d418117efd66f07c4d66781a962526762127467cb1e083
-
C:\Users\Admin\AppData\Local\ahLBLO\wextract.exeMD5
e78764b49f5806ce029cd547004493c9
SHA18c1f3f989913bebf827a707c04754047507a8cf3
SHA256ab519b1c2711219a9f262b23bf72343eec3c0df4c7ddd135d30d05e700ec302e
SHA51271040e5f0d2d409efaba70a7daaebe7a4675cb19009436a826a679671cc0d7c960498364ec7a29fb163ce8dada65218b75bebb973e6c8b194734e01970fd3a6b
-
C:\Users\Admin\AppData\Local\f8XoiMQ\NDFAPI.DLLMD5
475c944cda3c86d799768467b7cd1dc1
SHA168f4892df83a40f02d666923e098c7ee6eb793ea
SHA256b7361b25d6a80989d1ff2dd1e36197dad3838387ef7df97123eb2654d6493bf4
SHA5128387f0ec43e8797799d2736acaf2f2653257191eed7553e5c6441acf9a19c05f17533f243e9cf2bb3a742b33bdc2c964781867064896a2be324508cb99d4d2c0
-
C:\Users\Admin\AppData\Local\f8XoiMQ\msra.exeMD5
b00eb640229462c7080dc17e5805dfc9
SHA128b438b47d145b17c94cbec39b204ced6eccb5f1
SHA256529378155b8aa91ff47d1f015c96a373fdb12acef3811d2f8a7e3dff67fded3b
SHA512e962f71be1f25787710b8cb92453bcc19ff38921d01b2c892a4c61bfa09959377a73a95a02c0a62b1c93aaef7d9b4a43c196ca76ac7c7327abe85340bf94b6d2
-
C:\Users\Admin\AppData\Local\jqTE\DUI70.dllMD5
f4816d4c41f6ae0703c9825145bd67b8
SHA14cfcfaa412dc191fe94a996267ce02b8dad254f3
SHA2561684bfd08ae1277573205648f48451fba1f975dbd1136cb82f4d96c0470ef20e
SHA5127fd72a7a9ef92dc5e101acbd4da260d19ca836e8eac1243cd528224df4f03bd9ef32d9efa1c7a1cafa8ee28dcbe0bda0b4cd71fce108836df2c3197f89caaf4f
-
C:\Users\Admin\AppData\Local\jqTE\dpapimig.exeMD5
a210dd05d1e941a1ec04b134f39ef036
SHA186b5493ecf8f456ae56ede4b013b934b892572e0
SHA2563912f380049e362ca875ccb4fe064621197f0df999b35c593de382cf0c852988
SHA5129648ed1088af13717479f4739ecdfd604b463582fe3a9db43761b446c61e93856309fd1f8c993962d426af566497b9c8f7eaa3a5af069a7a0f8fde8424111bf8
-
\Users\Admin\AppData\Local\ahLBLO\VERSION.dllMD5
711aaf60b9af895c5100fb0c2f6ddf4c
SHA16ce71e953948e96c70593b404a9fcc3515095b5d
SHA256914d7ff908ced5d497260d400b71d75972f001c1467049d7f60c30fb8732acf0
SHA512ee7f713bdb1996e6d5e8412c30b8ec600b6ff0bbb8190cd23dcef45399531345362fa8acdc567bb458d418117efd66f07c4d66781a962526762127467cb1e083
-
\Users\Admin\AppData\Local\f8XoiMQ\NDFAPI.DLLMD5
475c944cda3c86d799768467b7cd1dc1
SHA168f4892df83a40f02d666923e098c7ee6eb793ea
SHA256b7361b25d6a80989d1ff2dd1e36197dad3838387ef7df97123eb2654d6493bf4
SHA5128387f0ec43e8797799d2736acaf2f2653257191eed7553e5c6441acf9a19c05f17533f243e9cf2bb3a742b33bdc2c964781867064896a2be324508cb99d4d2c0
-
\Users\Admin\AppData\Local\jqTE\DUI70.dllMD5
f4816d4c41f6ae0703c9825145bd67b8
SHA14cfcfaa412dc191fe94a996267ce02b8dad254f3
SHA2561684bfd08ae1277573205648f48451fba1f975dbd1136cb82f4d96c0470ef20e
SHA5127fd72a7a9ef92dc5e101acbd4da260d19ca836e8eac1243cd528224df4f03bd9ef32d9efa1c7a1cafa8ee28dcbe0bda0b4cd71fce108836df2c3197f89caaf4f
-
memory/1392-4-0x0000000000000000-mapping.dmp
-
memory/1664-9-0x0000000000000000-mapping.dmp
-
memory/3044-3-0x0000000140000000-0x0000000140138000-memory.dmpFilesize
1.2MB
-
memory/3044-2-0x0000000140000000-0x0000000140138000-memory.dmpFilesize
1.2MB
-
memory/3044-1-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/3868-14-0x0000000000000000-mapping.dmp
-
memory/3940-0-0x0000000140000000-0x000000014008D000-memory.dmpFilesize
564KB