Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    25-10-2021 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe

  • Size

    1.2MB

  • MD5

    98c9398c958e6b0280c15108cde96186

  • SHA1

    9a34f808c61266af8bcc323c749a37508bb36f5d

  • SHA256

    530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8

  • SHA512

    502dfc6fec14ca4b136220ea224a7b0ac017758b615d7424c0e972c42962edaf137c69610a0486f08cffb59255ab700e4c55afcf41680d6a6f70d4485ae40344

Score
10/10
spywarestealersuricata

Malware Config

Signatures

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Win32/Voltron/Spectre Stealer Checkin Activity (GET)

    suricata: ET MALWARE Win32/Voltron/Spectre Stealer Checkin Activity (GET)

    suricata
  • suricata: ET MALWARE Win32/Voltron/Spectre Stealer CnC Activity (POST)

    suricata: ET MALWARE Win32/Voltron/Spectre Stealer CnC Activity (POST)

    suricata
  • suricata: ET MALWARE Win32/Voltron/Spectre Stealer Download Activity (GET)

    suricata: ET MALWARE Win32/Voltron/Spectre Stealer Download Activity (GET)

    suricata
  • suricata: ET MALWARE Win32/Voltron/Spectre Stealer Sending OS Information (POST)

    suricata: ET MALWARE Win32/Voltron/Spectre Stealer Sending OS Information (POST)

    suricata
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe
    "C:\Users\Admin\AppData\Local\Temp\530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Users\Admin\AppData\Local\Temp\530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe
      "C:\Users\Admin\AppData\Local\Temp\530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\IronPortCenter" & unzip.exe -o libraries.zip
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Users\Admin\AppData\Roaming\IronPortCenter\unzip.exe
          unzip.exe -o libraries.zip
          4⤵
          • Executes dropped EXE
          PID:3088
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\IronPortCenter\PsInfo64.exe /accepteula kernel > "C:\Users\Admin\AppData\Roaming\IronPortCenter\os_out"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Users\Admin\AppData\Roaming\IronPortCenter\PsInfo64.exe
          C:\Users\Admin\AppData\Roaming\IronPortCenter\PsInfo64.exe /accepteula kernel
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:912
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\IronPortCenter.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Temp\530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8.exe';$s.Save()"
        3⤵
          PID:1244
        • C:\Users\Admin\AppData\Local\temp\dwm.exe
          "C:\Users\Admin\AppData\Local\temp\dwm.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1504
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\IronPortCenter\7za.exe x "C:\Users\Admin\AppData\Local\temp\chromium89.7z" -o"C:\Users\Admin\AppData\Roaming"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Users\Admin\AppData\Roaming\IronPortCenter\7za.exe
            C:\Users\Admin\AppData\Roaming\IronPortCenter\7za.exe x "C:\Users\Admin\AppData\Local\temp\chromium89.7z" -o"C:\Users\Admin\AppData\Roaming"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2188

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dwm.exe
      MD5

      f88c058646225de6e3cddc39ea0c9ff7

      SHA1

      a7987fab49ee81b9a86965bd6dbd14bc0140a27c

      SHA256

      8dca2819e4395eb497f4246dc808a5efb1cd805a70825bda636240facd8dd66c

      SHA512

      c6a7a330372ce389758e4339954b248e825df0b8872f01993aa547fba816fbaa91086d61f30fdaf25bd35ff0bbe550ccc4b73c5b061916a62a2380b9ced9352f

      Download Submit
    • C:\Users\Admin\AppData\Local\temp\chromium89.7z
      MD5

      4c127ed294686a00b6bc414c3984c185

      SHA1

      128b851818a350e9ee46cd1ef7e8bb19dee759cd

      SHA256

      65f335226ab7d0b47d424aa3391c240352c25dddbc666b12c67c583140691d2c

      SHA512

      7cc88e3caabd42652030f441d867b577b7ab2fc1b7886f69c43745778918323d551ddd5e61218cfa54b2d40338cc2f111983ce583df9f1eb8aada530ce645aaf

      Download Submit
    • C:\Users\Admin\AppData\Local\temp\dwm.exe
      MD5

      f88c058646225de6e3cddc39ea0c9ff7

      SHA1

      a7987fab49ee81b9a86965bd6dbd14bc0140a27c

      SHA256

      8dca2819e4395eb497f4246dc808a5efb1cd805a70825bda636240facd8dd66c

      SHA512

      c6a7a330372ce389758e4339954b248e825df0b8872f01993aa547fba816fbaa91086d61f30fdaf25bd35ff0bbe550ccc4b73c5b061916a62a2380b9ced9352f

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\7za.exe
      MD5

      0184e6ebe133ef41a8cc6ef98a263712

      SHA1

      cb9f603e061aef833a2db501aa8ba6ba007d768e

      SHA256

      dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229

      SHA512

      6fec04e7369858970063e94358aec7fe872886b5ea440b4a11713b08511ba3ebe8f3d9312e32883b38bae66e42bc8e208e11678c383a5ad0f7cc0abe29c3a8ed

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\7za.exe
      MD5

      0184e6ebe133ef41a8cc6ef98a263712

      SHA1

      cb9f603e061aef833a2db501aa8ba6ba007d768e

      SHA256

      dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229

      SHA512

      6fec04e7369858970063e94358aec7fe872886b5ea440b4a11713b08511ba3ebe8f3d9312e32883b38bae66e42bc8e208e11678c383a5ad0f7cc0abe29c3a8ed

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\PsInfo64.exe
      MD5

      efa2f8f73b3559711149dfdeb8bc288e

      SHA1

      453c70e4b12ecabe860866165ad39de6361215fd

      SHA256

      ef5cf80c8448bf0907c634a3251cc348b1d36bb5ad8f31f23b11d12aa7f63bcb

      SHA512

      63f75a3d639a912e2e3966e9d410f8e1c52b75300518bb5083853ef2633c7e109c037ea2b66ced57bd5b319866a14bcd92254cb38ab9ec7b99465b0a8a8f5f3e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\PsInfo64.exe
      MD5

      efa2f8f73b3559711149dfdeb8bc288e

      SHA1

      453c70e4b12ecabe860866165ad39de6361215fd

      SHA256

      ef5cf80c8448bf0907c634a3251cc348b1d36bb5ad8f31f23b11d12aa7f63bcb

      SHA512

      63f75a3d639a912e2e3966e9d410f8e1c52b75300518bb5083853ef2633c7e109c037ea2b66ced57bd5b319866a14bcd92254cb38ab9ec7b99465b0a8a8f5f3e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\libraries.zip
      MD5

      dc28d93d4ffd9849985c0dedf6425074

      SHA1

      224d0b1ddb2952372d66495e6432d826b3bfac02

      SHA256

      53515197bbbc76b3b7e6b0c5da2c078cc71d7c86208ca04ea5e5fca92547d2c2

      SHA512

      a91b78ecbcafd54e327700b494ef56ed85f270cba46765f5fcae3d4a8f9b80074a663c9d29e842ea55a7398cc650edec9a7667e0a1de87f43bf5f0a1f71cf1ff

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\mozglue.dll
      MD5

      beee632711993fe38cf290a9d301df42

      SHA1

      5c4b214cf77b0e781124b8295ec55263b90d0707

      SHA256

      f7e8d6214a4ffc3188adf133fcbe9f036571a6b6c90718eadbb10339f27c9d9b

      SHA512

      c00ebcc7b12ec456046f95e128cf23636d9fa2af6877a4e994858f8f97088f569dbd720f130db243e0f6f382b60b9636a52d151435f8d65c7eaab3025b1af97f

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\nss3.dll
      MD5

      0cab66732ed0978c1c5d2c378613c504

      SHA1

      8d3102b25a1fd36e0f9d4a33f05da107065f0e7a

      SHA256

      101f57145ea784442b4bc267fdfcfab754ee664ca974138838ece9fc4bb4c84d

      SHA512

      cc49bf303158788023295fb406eec9886b44297e3be5d06a1f14d793d09bf66609025731b2c6c97ade17e9c8d4da480d4ba53ac427dcc459fcae9678b8f767da

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\os_out
      MD5

      8d674deeaa4e2ce797b6e056ce30d430

      SHA1

      9a8cb27ea969b176df4f7f1abbd0c61036dcd1ed

      SHA256

      ba5336c6168c0ea808059fc8af68be1bce63a0215cbf064c172cb1e46816ce34

      SHA512

      311655dacec23f6aa25f26a7d59c86e9d47c4215de071d6d532cae8f4234cb7023f45d4dea40c7c1c05880c31de040f599f7947a7ba1ab113191f9f434db9370

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\sqlite3.dll
      MD5

      9502f3ae1cc9398671edfd461275d78d

      SHA1

      61e7dbbc8b44db32fa9d3841275718dbd163cd45

      SHA256

      badca203e5d4d79d2107b9ec2c64547157288a43932bb973719375e9ed8d5d12

      SHA512

      79d5e5875218bbc6288500c29b72845fb6427b9cefe9916c13c3301c0c7e02c21a576a597e74532b41932ec4343a21599c252ad5b34c547650f9c5f817ab09eb

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\unzip.exe
      MD5

      75375c22c72f1beb76bea39c22a1ed68

      SHA1

      e1652b058195db3f5f754b7ab430652ae04a50b8

      SHA256

      8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

      SHA512

      1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\IronPortCenter\unzip.exe
      MD5

      75375c22c72f1beb76bea39c22a1ed68

      SHA1

      e1652b058195db3f5f754b7ab430652ae04a50b8

      SHA256

      8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

      SHA512

      1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a

      Download Submit
    • \Users\Admin\AppData\Roaming\IronPortCenter\mozglue.dll
      MD5

      beee632711993fe38cf290a9d301df42

      SHA1

      5c4b214cf77b0e781124b8295ec55263b90d0707

      SHA256

      f7e8d6214a4ffc3188adf133fcbe9f036571a6b6c90718eadbb10339f27c9d9b

      SHA512

      c00ebcc7b12ec456046f95e128cf23636d9fa2af6877a4e994858f8f97088f569dbd720f130db243e0f6f382b60b9636a52d151435f8d65c7eaab3025b1af97f

      Download Submit
    • \Users\Admin\AppData\Roaming\IronPortCenter\nss3.dll
      MD5

      0cab66732ed0978c1c5d2c378613c504

      SHA1

      8d3102b25a1fd36e0f9d4a33f05da107065f0e7a

      SHA256

      101f57145ea784442b4bc267fdfcfab754ee664ca974138838ece9fc4bb4c84d

      SHA512

      cc49bf303158788023295fb406eec9886b44297e3be5d06a1f14d793d09bf66609025731b2c6c97ade17e9c8d4da480d4ba53ac427dcc459fcae9678b8f767da

      Download Submit
    • \Users\Admin\AppData\Roaming\IronPortCenter\sqlite3.dll
      MD5

      9502f3ae1cc9398671edfd461275d78d

      SHA1

      61e7dbbc8b44db32fa9d3841275718dbd163cd45

      SHA256

      badca203e5d4d79d2107b9ec2c64547157288a43932bb973719375e9ed8d5d12

      SHA512

      79d5e5875218bbc6288500c29b72845fb6427b9cefe9916c13c3301c0c7e02c21a576a597e74532b41932ec4343a21599c252ad5b34c547650f9c5f817ab09eb

      Download Submit
    • memory/640-125-0x0000000000000000-mapping.dmp
      Download
    • memory/912-126-0x0000000000000000-mapping.dmp
      Download
    • memory/1244-136-0x0000000000000000-mapping.dmp
      Download
    • memory/1504-137-0x0000000000000000-mapping.dmp
      Download
    • memory/1872-142-0x0000000000000000-mapping.dmp
      Download
    • memory/1884-120-0x0000000000000000-mapping.dmp
      Download
    • memory/2188-143-0x0000000000000000-mapping.dmp
      Download
    • memory/3024-117-0x0000000000400000-0x0000000000479000-memory.dmp
      Filesize

      484KB

      Download
    • memory/3024-119-0x0000000000400000-0x0000000000479000-memory.dmp
      Filesize

      484KB

      Download
    • memory/3024-118-0x0000000000437162-mapping.dmp
      Download
    • memory/3088-121-0x0000000000000000-mapping.dmp
      Download