Resubmissions
28-05-2021 05:59
210528-mj2qwc9z3x 1019-05-2021 14:41
210519-khtrssqv6a 1010-05-2021 18:06
210510-ncy7w9kqte 10Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-05-2021 18:06
Static task
static1
Behavioral task
behavioral1
Sample
93394d6e_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
93394d6e_by_Libranalysis.dll
-
Size
588KB
-
MD5
93394d6e0ea894922267955095fabbc9
-
SHA1
38ac582b64fb09f212aceddf5e3cc13946c69985
-
SHA256
7f0f199833687549249b22ec50bbcb234d2ad2b8da993a6cbc86db8a53236530
-
SHA512
aceecbcccd6fe48586d695b0ef04d7d0b998069dbb6545dc9ca96045f896281663027cf048ce2d0f27d0e2990f03c1f592322bfa9bc9776f153d07c6993cc8e7
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3992-114-0x0000000140000000-0x000000014009D000-memory.dmp dridex_payload behavioral2/memory/3776-139-0x0000000140000000-0x000000014009E000-memory.dmp dridex_payload -
resource yara_rule behavioral2/memory/3036-120-0x0000000000660000-0x0000000000661000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 3776 sppsvc.exe 3296 SppExtComObj.Exe 1160 CloudNotifications.exe -
Loads dropped DLL 3 IoCs
pid Process 3776 sppsvc.exe 3296 SppExtComObj.Exe 1160 CloudNotifications.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jngmlmox = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3686645723-710336880-414668232-1000\\Yv\\SppExtComObj.Exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sppsvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CloudNotifications.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3992 rundll32.exe 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3036 Process not Found -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3776 3036 Process not Found 80 PID 3036 wrote to memory of 3776 3036 Process not Found 80 PID 3036 wrote to memory of 3464 3036 Process not Found 81 PID 3036 wrote to memory of 3464 3036 Process not Found 81 PID 3036 wrote to memory of 3296 3036 Process not Found 82 PID 3036 wrote to memory of 3296 3036 Process not Found 82 PID 3036 wrote to memory of 1360 3036 Process not Found 83 PID 3036 wrote to memory of 1360 3036 Process not Found 83 PID 3036 wrote to memory of 1160 3036 Process not Found 84 PID 3036 wrote to memory of 1160 3036 Process not Found 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93394d6e_by_Libranalysis.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3992
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:1516
-
C:\Users\Admin\AppData\Local\aGi7FNo3\sppsvc.exeC:\Users\Admin\AppData\Local\aGi7FNo3\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3776
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵PID:3464
-
C:\Users\Admin\AppData\Local\ehxOzmz\SppExtComObj.ExeC:\Users\Admin\AppData\Local\ehxOzmz\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3296
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵PID:1360
-
C:\Users\Admin\AppData\Local\Qr1qP\CloudNotifications.exeC:\Users\Admin\AppData\Local\Qr1qP\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1160