Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30-09-2021 07:42
Static task
static1
Behavioral task
behavioral1
Sample
30b8a22979fcf9cd5eadbaf0683b68dce6608e4507079f508ebf5e9f3a4cb3f9.dll
Resource
win7-en-20210920
General
-
Target
30b8a22979fcf9cd5eadbaf0683b68dce6608e4507079f508ebf5e9f3a4cb3f9.dll
-
Size
1.2MB
-
MD5
050f7b6b85755449ad51107dd8be3946
-
SHA1
1c04df714fa68afabc5c9e3528ae7a3114b55078
-
SHA256
30b8a22979fcf9cd5eadbaf0683b68dce6608e4507079f508ebf5e9f3a4cb3f9
-
SHA512
f06deb19569c9d52ffc8c5d3d4b221cc327b57073819471e27623f7e4e93384f33d82478da3c8a7ecbef4f02138c7a69af0e38bdab1a7d7e386456112599d297
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1264-57-0x0000000002B30000-0x0000000002B31000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 4 IoCs
Processes:
SnippingTool.exedpnsvr.exeDeviceDisplayObjectProvider.execmstp.exepid process 1888 SnippingTool.exe 2024 dpnsvr.exe 1048 DeviceDisplayObjectProvider.exe 1256 cmstp.exe -
Loads dropped DLL 9 IoCs
Processes:
SnippingTool.exedpnsvr.exeDeviceDisplayObjectProvider.execmstp.exepid process 1264 1888 SnippingTool.exe 1264 2024 dpnsvr.exe 1264 1048 DeviceDisplayObjectProvider.exe 1264 1256 cmstp.exe 1264 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wbbdywj = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\v42sMa\\DEVICE~1.EXE" -
Processes:
dpnsvr.exeDeviceDisplayObjectProvider.execmstp.exerundll32.exeSnippingTool.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dpnsvr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeviceDisplayObjectProvider.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmstp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SnippingTool.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1356 rundll32.exe 1356 rundll32.exe 1356 rundll32.exe 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 1264 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1264 -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1264 1264 1264 1264 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1264 1264 1264 1264 -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
description pid process target process PID 1264 wrote to memory of 1200 1264 SnippingTool.exe PID 1264 wrote to memory of 1200 1264 SnippingTool.exe PID 1264 wrote to memory of 1200 1264 SnippingTool.exe PID 1264 wrote to memory of 1888 1264 SnippingTool.exe PID 1264 wrote to memory of 1888 1264 SnippingTool.exe PID 1264 wrote to memory of 1888 1264 SnippingTool.exe PID 1264 wrote to memory of 1312 1264 dpnsvr.exe PID 1264 wrote to memory of 1312 1264 dpnsvr.exe PID 1264 wrote to memory of 1312 1264 dpnsvr.exe PID 1264 wrote to memory of 2024 1264 dpnsvr.exe PID 1264 wrote to memory of 2024 1264 dpnsvr.exe PID 1264 wrote to memory of 2024 1264 dpnsvr.exe PID 1264 wrote to memory of 1812 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1812 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1812 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1048 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1048 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1048 1264 DeviceDisplayObjectProvider.exe PID 1264 wrote to memory of 1868 1264 cmstp.exe PID 1264 wrote to memory of 1868 1264 cmstp.exe PID 1264 wrote to memory of 1868 1264 cmstp.exe PID 1264 wrote to memory of 1256 1264 cmstp.exe PID 1264 wrote to memory of 1256 1264 cmstp.exe PID 1264 wrote to memory of 1256 1264 cmstp.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30b8a22979fcf9cd5eadbaf0683b68dce6608e4507079f508ebf5e9f3a4cb3f9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1356
-
C:\Windows\system32\SnippingTool.exeC:\Windows\system32\SnippingTool.exe1⤵PID:1200
-
C:\Users\Admin\AppData\Local\6LEpS\SnippingTool.exeC:\Users\Admin\AppData\Local\6LEpS\SnippingTool.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1888
-
C:\Windows\system32\dpnsvr.exeC:\Windows\system32\dpnsvr.exe1⤵PID:1312
-
C:\Users\Admin\AppData\Local\VCN43sfJR\dpnsvr.exeC:\Users\Admin\AppData\Local\VCN43sfJR\dpnsvr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2024
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵PID:1812
-
C:\Users\Admin\AppData\Local\ZWazWQ\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\ZWazWQ\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1048
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵PID:1868
-
C:\Users\Admin\AppData\Local\zgqe\cmstp.exeC:\Users\Admin\AppData\Local\zgqe\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1256
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\6LEpS\SnippingTool.exeMD5
7633f554eeafde7f144b41c2fcaf5f63
SHA144497c3d6fada0066598a6170b90c53e28ddf96c
SHA256890884c7fe7d037e6debd21d1877e9c9c5e7790cdba007ddb219ae6a55667f78
SHA5127b61b6736c2c4f49d80f53c839914ad845f86a7d921fee1557e49aa7b4e9713e3483417d6c717eca155229bb6a90fc2253e1543cf05192aaf08262dc761fa203
-
C:\Users\Admin\AppData\Local\6LEpS\UxTheme.dllMD5
37bd16eade5ad06b88bd8b246cbc2f2d
SHA16453ae51ca6d42b1455da2710d6401f1af6e712c
SHA256059d5713b0bb113bdee6b0fc6a43a4f381b42d862b844687f6de05042af62352
SHA512129d6438609e58232c2609b1239e7c9db03d03521a0475dd8572c6eb4e0aa82e8371f59bed126644d794fd319062a7b43d9154663fe7facec254bbdb8ba8b206
-
C:\Users\Admin\AppData\Local\VCN43sfJR\WINMM.dllMD5
f4711067c8bba6130095ed63881a73d1
SHA114cd00f2da0c6093ed0c13b905b2bb258af93e84
SHA2569a0cee85c3062fe1c0357e8c194edfb076c7ff56c7de661ff11000513fbfa1b9
SHA51253f94383d19d5b76613d7ec909479d69af2e8ef2ebfcaca20e71513b5fd915d9373eca655abb4a413492fab3250b59994523cf848c93917996e554480de06264
-
C:\Users\Admin\AppData\Local\VCN43sfJR\dpnsvr.exeMD5
6806b72978f6bd27aef57899be68b93b
SHA1713c246d0b0b8dcc298afaed4f62aed82789951c
SHA2563485ee4159c5f9e4ed9dd06e668d1e04148154ff40327a9ccb591e8c5a79958c
SHA51243c942358b2e949751149ecc4be5ff6cb0634957ff1128ad5e6051e83379fb5643100cae2f6ef3eaf36aff016063c150e93297aa866e780d0e4d51656a251c7b
-
C:\Users\Admin\AppData\Local\ZWazWQ\DeviceDisplayObjectProvider.exeMD5
7e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
C:\Users\Admin\AppData\Local\ZWazWQ\XmlLite.dllMD5
4988e760111654203c10e6141b1d33fc
SHA16c0b3614e952ef987e3fdfc50aa5254a07a6f4b5
SHA256d6d70b3038ecf9a9d26e47e2149855fc653820a261ffc4dc52f9080e2c79a3fc
SHA5124bb92e3bb1f773a7116adb195b0aa9e0670f54be5264aab7ae3728ea2f31a8c1a637479a958db817f5a1aef3f72926712e9c2013d7ea813f87372ec7f413a6d4
-
C:\Users\Admin\AppData\Local\zgqe\VERSION.dllMD5
07a3942a29cac7e281e2a0dc5a97e57d
SHA19e3335221150a213f56dbb801f147627f15ce1a3
SHA256062319ecd2422bc06fb910110ee84fcee5af94d6d7b35201cb67c39975a4cac5
SHA512b35257ba913d9a6b9b365f598420e6d6ba569c9675eea2c587c179534a396c412cb841c08b3c82f00a19184affd0eea6555f23e6d29f658dc8ce0dfc66d1545e
-
C:\Users\Admin\AppData\Local\zgqe\cmstp.exeMD5
74c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
\Users\Admin\AppData\Local\6LEpS\SnippingTool.exeMD5
7633f554eeafde7f144b41c2fcaf5f63
SHA144497c3d6fada0066598a6170b90c53e28ddf96c
SHA256890884c7fe7d037e6debd21d1877e9c9c5e7790cdba007ddb219ae6a55667f78
SHA5127b61b6736c2c4f49d80f53c839914ad845f86a7d921fee1557e49aa7b4e9713e3483417d6c717eca155229bb6a90fc2253e1543cf05192aaf08262dc761fa203
-
\Users\Admin\AppData\Local\6LEpS\UxTheme.dllMD5
37bd16eade5ad06b88bd8b246cbc2f2d
SHA16453ae51ca6d42b1455da2710d6401f1af6e712c
SHA256059d5713b0bb113bdee6b0fc6a43a4f381b42d862b844687f6de05042af62352
SHA512129d6438609e58232c2609b1239e7c9db03d03521a0475dd8572c6eb4e0aa82e8371f59bed126644d794fd319062a7b43d9154663fe7facec254bbdb8ba8b206
-
\Users\Admin\AppData\Local\VCN43sfJR\WINMM.dllMD5
f4711067c8bba6130095ed63881a73d1
SHA114cd00f2da0c6093ed0c13b905b2bb258af93e84
SHA2569a0cee85c3062fe1c0357e8c194edfb076c7ff56c7de661ff11000513fbfa1b9
SHA51253f94383d19d5b76613d7ec909479d69af2e8ef2ebfcaca20e71513b5fd915d9373eca655abb4a413492fab3250b59994523cf848c93917996e554480de06264
-
\Users\Admin\AppData\Local\VCN43sfJR\dpnsvr.exeMD5
6806b72978f6bd27aef57899be68b93b
SHA1713c246d0b0b8dcc298afaed4f62aed82789951c
SHA2563485ee4159c5f9e4ed9dd06e668d1e04148154ff40327a9ccb591e8c5a79958c
SHA51243c942358b2e949751149ecc4be5ff6cb0634957ff1128ad5e6051e83379fb5643100cae2f6ef3eaf36aff016063c150e93297aa866e780d0e4d51656a251c7b
-
\Users\Admin\AppData\Local\ZWazWQ\DeviceDisplayObjectProvider.exeMD5
7e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
\Users\Admin\AppData\Local\ZWazWQ\XmlLite.dllMD5
4988e760111654203c10e6141b1d33fc
SHA16c0b3614e952ef987e3fdfc50aa5254a07a6f4b5
SHA256d6d70b3038ecf9a9d26e47e2149855fc653820a261ffc4dc52f9080e2c79a3fc
SHA5124bb92e3bb1f773a7116adb195b0aa9e0670f54be5264aab7ae3728ea2f31a8c1a637479a958db817f5a1aef3f72926712e9c2013d7ea813f87372ec7f413a6d4
-
\Users\Admin\AppData\Local\zgqe\VERSION.dllMD5
07a3942a29cac7e281e2a0dc5a97e57d
SHA19e3335221150a213f56dbb801f147627f15ce1a3
SHA256062319ecd2422bc06fb910110ee84fcee5af94d6d7b35201cb67c39975a4cac5
SHA512b35257ba913d9a6b9b365f598420e6d6ba569c9675eea2c587c179534a396c412cb841c08b3c82f00a19184affd0eea6555f23e6d29f658dc8ce0dfc66d1545e
-
\Users\Admin\AppData\Local\zgqe\cmstp.exeMD5
74c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\igGO6L9I\cmstp.exeMD5
74c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
memory/1048-116-0x0000000000000000-mapping.dmp
-
memory/1256-123-0x0000000000000000-mapping.dmp
-
memory/1264-71-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-66-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-76-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-77-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-78-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-79-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-80-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-90-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-89-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-88-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-87-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-86-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-93-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-92-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-91-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-85-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-84-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-83-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-82-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-81-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-99-0x0000000077BA0000-0x0000000077BA2000-memory.dmpFilesize
8KB
-
memory/1264-73-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-74-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-57-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB
-
memory/1264-58-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-72-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-59-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-60-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-70-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-69-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-61-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-68-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-67-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-62-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-75-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-65-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-64-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1264-63-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1356-54-0x0000000140000000-0x000000014012F000-memory.dmpFilesize
1.2MB
-
memory/1356-56-0x0000000001B60000-0x0000000001B67000-memory.dmpFilesize
28KB
-
memory/1888-106-0x0000000140000000-0x0000000140130000-memory.dmpFilesize
1.2MB
-
memory/1888-103-0x000007FEFC271000-0x000007FEFC273000-memory.dmpFilesize
8KB
-
memory/1888-101-0x0000000000000000-mapping.dmp
-
memory/2024-113-0x0000000140000000-0x0000000140131000-memory.dmpFilesize
1.2MB
-
memory/2024-109-0x0000000000000000-mapping.dmp