Resubmissions
28-05-2021 05:59
210528-mj2qwc9z3x 1019-05-2021 14:41
210519-khtrssqv6a 1010-05-2021 18:06
210510-ncy7w9kqte 10Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-05-2021 18:06
Static task
static1
Behavioral task
behavioral1
Sample
93394d6e_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
93394d6e_by_Libranalysis.dll
-
Size
588KB
-
MD5
93394d6e0ea894922267955095fabbc9
-
SHA1
38ac582b64fb09f212aceddf5e3cc13946c69985
-
SHA256
7f0f199833687549249b22ec50bbcb234d2ad2b8da993a6cbc86db8a53236530
-
SHA512
aceecbcccd6fe48586d695b0ef04d7d0b998069dbb6545dc9ca96045f896281663027cf048ce2d0f27d0e2990f03c1f592322bfa9bc9776f153d07c6993cc8e7
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1864-60-0x0000000140000000-0x000000014009D000-memory.dmp dridex_payload behavioral1/memory/436-80-0x0000000140000000-0x00000001400D1000-memory.dmp dridex_payload behavioral1/memory/624-88-0x0000000140000000-0x000000014009E000-memory.dmp dridex_payload -
resource yara_rule behavioral1/memory/1224-63-0x0000000003960000-0x0000000003961000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 436 dpapimig.exe 624 DeviceDisplayObjectProvider.exe 1304 rdrleakdiag.exe -
Loads dropped DLL 7 IoCs
pid Process 1224 Process not Found 436 dpapimig.exe 1224 Process not Found 624 DeviceDisplayObjectProvider.exe 1224 Process not Found 1304 rdrleakdiag.exe 1224 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Srlqp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\gppQHM99IU\\DeviceDisplayObjectProvider.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dpapimig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeviceDisplayObjectProvider.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rdrleakdiag.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 436 dpapimig.exe 436 dpapimig.exe 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 624 DeviceDisplayObjectProvider.exe 624 DeviceDisplayObjectProvider.exe 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1224 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1224 Process not Found 1224 Process not Found 1224 Process not Found 1224 Process not Found -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1684 1224 Process not Found 29 PID 1224 wrote to memory of 1684 1224 Process not Found 29 PID 1224 wrote to memory of 1684 1224 Process not Found 29 PID 1224 wrote to memory of 436 1224 Process not Found 30 PID 1224 wrote to memory of 436 1224 Process not Found 30 PID 1224 wrote to memory of 436 1224 Process not Found 30 PID 1224 wrote to memory of 1044 1224 Process not Found 31 PID 1224 wrote to memory of 1044 1224 Process not Found 31 PID 1224 wrote to memory of 1044 1224 Process not Found 31 PID 1224 wrote to memory of 624 1224 Process not Found 32 PID 1224 wrote to memory of 624 1224 Process not Found 32 PID 1224 wrote to memory of 624 1224 Process not Found 32 PID 1224 wrote to memory of 972 1224 Process not Found 33 PID 1224 wrote to memory of 972 1224 Process not Found 33 PID 1224 wrote to memory of 972 1224 Process not Found 33 PID 1224 wrote to memory of 1304 1224 Process not Found 34 PID 1224 wrote to memory of 1304 1224 Process not Found 34 PID 1224 wrote to memory of 1304 1224 Process not Found 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93394d6e_by_Libranalysis.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵PID:1684
-
C:\Users\Admin\AppData\Local\rs2\dpapimig.exeC:\Users\Admin\AppData\Local\rs2\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:436
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵PID:1044
-
C:\Users\Admin\AppData\Local\tKQ1RY45a\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\tKQ1RY45a\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:624
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵PID:972
-
C:\Users\Admin\AppData\Local\QAuM3O0f\rdrleakdiag.exeC:\Users\Admin\AppData\Local\QAuM3O0f\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1304