Analysis
- max time kernel
153s - max time network
146s - platform
windows7_x64 - resource
win7-en - submitted
09/09/2021, 11:52
Static task
static1
Behavioral task
behavioral1
Sample
92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220.dll
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
- Target 92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220.dll
- Size 1.8MB
- Sample210909-n1rtxabcan
- SHA256 92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220
- MD5 669b26e61f45a13d9d48e29494690cf8
- SHA1 e5373ca694ad170eeffdf0a5426caafdc1a959ae
- SHA512 47d35c22b4c549a42118b1b27889cbe3046115141b3bbd30c0803693ba7dd7172c135ae5dbba39676455b89cd13e9618b6c87314e8c0740246a38f04c89fb69c
- MD5 SHA1 SHA512
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1212-56-0x0000000003AC0000-0x0000000003AC1000-memory.dmp dridex_stager_shellcode - Executes dropped EXE 3 IoCs
pid Process 2012 perfmon.exe 1172 msdtc.exe 1340 WindowsAnytimeUpgradeui.exe - Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew Process not Found File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew\credui.dll Process not Found File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew\perfmon.exe Process not Found File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew\1t Process not Found File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew\1t\slc.dll Process not Found File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jFhb0ew\1t\WindowsAnytimeUpgradeui.exe Process not Found - Loads dropped DLL 7 IoCs
pid Process 1212 Process not Found 2012 perfmon.exe 1212 Process not Found 1172 msdtc.exe 1212 Process not Found 1340 WindowsAnytimeUpgradeui.exe 1212 Process not Found - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gtdwm = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\9.0\\Collab\\QLXmVkHer\\msdtc.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA perfmon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msdtc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WindowsAnytimeUpgradeui.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1212 Process not Found - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1212 wrote to memory of 1096 1212 Process not Found 30 PID 1212 wrote to memory of 1096 1212 Process not Found 30 PID 1212 wrote to memory of 1096 1212 Process not Found 30 PID 1212 wrote to memory of 2012 1212 Process not Found 31 PID 1212 wrote to memory of 2012 1212 Process not Found 31 PID 1212 wrote to memory of 2012 1212 Process not Found 31 PID 1212 wrote to memory of 1996 1212 Process not Found 32 PID 1212 wrote to memory of 1996 1212 Process not Found 32 PID 1212 wrote to memory of 1996 1212 Process not Found 32 PID 1212 wrote to memory of 1172 1212 Process not Found 33 PID 1212 wrote to memory of 1172 1212 Process not Found 33 PID 1212 wrote to memory of 1172 1212 Process not Found 33 PID 1212 wrote to memory of 1568 1212 Process not Found 34 PID 1212 wrote to memory of 1568 1212 Process not Found 34 PID 1212 wrote to memory of 1568 1212 Process not Found 34 PID 1212 wrote to memory of 1340 1212 Process not Found 35 PID 1212 wrote to memory of 1340 1212 Process not Found 35 PID 1212 wrote to memory of 1340 1212 Process not Found 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1148
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵PID:1096
-
C:\Users\Admin\AppData\Local\EuXUGWy\perfmon.exeC:\Users\Admin\AppData\Local\EuXUGWy\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2012
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵PID:1996
-
C:\Users\Admin\AppData\Local\bXwh5\msdtc.exeC:\Users\Admin\AppData\Local\bXwh5\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1172
-
C:\Windows\system32\WindowsAnytimeUpgradeui.exeC:\Windows\system32\WindowsAnytimeUpgradeui.exe1⤵PID:1568
-
C:\Users\Admin\AppData\Local\zDY4\WindowsAnytimeUpgradeui.exeC:\Users\Admin\AppData\Local\zDY4\WindowsAnytimeUpgradeui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1340