Analysis
-
max time kernel
154s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
26-11-2021 09:28
Static task
static1
Behavioral task
behavioral1
Sample
bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0.dll
Resource
win7-en-20211014
General
-
Target
bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0.dll
-
Size
1.3MB
-
MD5
ea8f8ba711d9aed9d2f3fa4315dffb76
-
SHA1
234ca58512cecae30be256089c1d9f39bd55d116
-
SHA256
bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0
-
SHA512
54473e1e81306e8d17317aa01cb8f184d0c82b534e8530b3bab499e27b1dc2c55b2163e61b535df817d732e74b2644e3615e0831d7e462d6f6b7e21f4c396270
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1920-125-0x0000000000CF0000-0x0000000000CF1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
tcmsetup.exesessionmsg.exeSndVol.exepid process 1984 tcmsetup.exe 3952 sessionmsg.exe 2860 SndVol.exe -
Loads dropped DLL 3 IoCs
Processes:
tcmsetup.exesessionmsg.exeSndVol.exepid process 1984 tcmsetup.exe 3952 sessionmsg.exe 2860 SndVol.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ziekmjidk = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\5ZO7OZBA\\sessionmsg.exe" -
Processes:
tcmsetup.exesessionmsg.exeSndVol.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tcmsetup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sessionmsg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SndVol.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exetcmsetup.exepid process 2716 rundll32.exe 2716 rundll32.exe 2716 rundll32.exe 2716 rundll32.exe 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1984 tcmsetup.exe 1984 tcmsetup.exe 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 1920 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1920 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid process target process PID 1920 wrote to memory of 1084 1920 tcmsetup.exe PID 1920 wrote to memory of 1084 1920 tcmsetup.exe PID 1920 wrote to memory of 1984 1920 tcmsetup.exe PID 1920 wrote to memory of 1984 1920 tcmsetup.exe PID 1920 wrote to memory of 3968 1920 sessionmsg.exe PID 1920 wrote to memory of 3968 1920 sessionmsg.exe PID 1920 wrote to memory of 3952 1920 sessionmsg.exe PID 1920 wrote to memory of 3952 1920 sessionmsg.exe PID 1920 wrote to memory of 1524 1920 SndVol.exe PID 1920 wrote to memory of 1524 1920 SndVol.exe PID 1920 wrote to memory of 2860 1920 SndVol.exe PID 1920 wrote to memory of 2860 1920 SndVol.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\gZC\tcmsetup.exeC:\Users\Admin\AppData\Local\gZC\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sessionmsg.exeC:\Windows\system32\sessionmsg.exe1⤵
-
C:\Users\Admin\AppData\Local\JXURtV\sessionmsg.exeC:\Users\Admin\AppData\Local\JXURtV\sessionmsg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\g8v\SndVol.exeC:\Users\Admin\AppData\Local\g8v\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\JXURtV\DUI70.dllMD5
0930af99d9bb69a85f6300f4a319d94a
SHA1f8b119c118ee1dd4cd221eb5177c24722da5b2b3
SHA2562ac8d64c76ff2ff6cabee2449868a042f70c9f9e4e3c0d68a37f4792b06fc2d0
SHA5122794358851f5b4ecefaf822cd75e5688b612e6c9b7ad0d8899223734a8522228b64dae8d835a83211140d4ff42bde8feb11584c441b5b4cbbcacf6dba02146b1
-
C:\Users\Admin\AppData\Local\JXURtV\sessionmsg.exeMD5
c9a3d374ad75f5d9ee720412c96b6f94
SHA15cec5ea0e5f5a6ed7e4726fe39e50563a351c9c8
SHA2564b54ea036af8b81b91bd4fbb04b4405d4c788f178a177201e66a7bc6fb778a0d
SHA512a63730ef7ade9dcfa5afecefe92eb897f9bb4284049b49445f95f44228173ccd5890e65e2b6257f8c4431b468b9b1d664c5cc1b836240413a20fb7b46e49b0ec
-
C:\Users\Admin\AppData\Local\g8v\SndVol.exeMD5
27205270f880954ac16dbe3436a8699a
SHA1c94dee99c7a19f85be8feef0019969b972894437
SHA2569520ffcee5ece79190dcccc9020e212d43aa6f58e2e633e2a5ed701e909abb6f
SHA5125e9cbc33cb583c93db4df7781c8960185703da554db81b31087545cc82d4eaf7a3d94aa7aff2b9c999446c621896c264940f0b1c1b4ba0e71cb09ab3dcc6b44b
-
C:\Users\Admin\AppData\Local\g8v\dwmapi.dllMD5
daaebfae03de262832dcf12cab474a5c
SHA15fccc8375f2d3652e9f6d9ccc29e56fd4a497e5f
SHA2563d2d19c36ec671effb84e7bc7c5a49ccb4099a85299400e4768951b5ec13d65b
SHA5125d8d5bc83c2ade2d8dbbe36ff0aa92a75e29bad840f2b47e56ce758126dfb661048f95e34fdcece36c685f009bc9dbf34cde6dff89a8034a5093145aa6434504
-
C:\Users\Admin\AppData\Local\gZC\TAPI32.dllMD5
68384c06f836614dc416891bee821833
SHA1b6c7f82632f140990c6d6dac76dd64e00b04ca12
SHA256eed751952469985cd50b3d061530a04d2fe1a45a13c6b527803f4ba9e257200e
SHA51299e71bec9cceb2559a72f057aa01f7383ba4c3c89ec1d04459e55cc2ffa19e5c9d43f6376efaa27b86521f57fd563aa179c2587e83c07c7a5c042eab91d19393
-
C:\Users\Admin\AppData\Local\gZC\tcmsetup.exeMD5
2df4ef3fb9a10b575a7c7fbbd3a9ffed
SHA13e1d2598322e784415265d2ccfa66a025ee080b6
SHA256c0843fbd99489006f95f2fbd39814f9b642212b5af44a553e6359f243250f172
SHA51264b2337d61424cae1d8bc3f7b5db4d2b5524b735b6ac84597644a6c31270d93e3e53fd0512f0b0e75bf6cf05fa74c8eb670e416e75a3e523cb7968754eac55e9
-
\Users\Admin\AppData\Local\JXURtV\DUI70.dllMD5
0930af99d9bb69a85f6300f4a319d94a
SHA1f8b119c118ee1dd4cd221eb5177c24722da5b2b3
SHA2562ac8d64c76ff2ff6cabee2449868a042f70c9f9e4e3c0d68a37f4792b06fc2d0
SHA5122794358851f5b4ecefaf822cd75e5688b612e6c9b7ad0d8899223734a8522228b64dae8d835a83211140d4ff42bde8feb11584c441b5b4cbbcacf6dba02146b1
-
\Users\Admin\AppData\Local\g8v\dwmapi.dllMD5
daaebfae03de262832dcf12cab474a5c
SHA15fccc8375f2d3652e9f6d9ccc29e56fd4a497e5f
SHA2563d2d19c36ec671effb84e7bc7c5a49ccb4099a85299400e4768951b5ec13d65b
SHA5125d8d5bc83c2ade2d8dbbe36ff0aa92a75e29bad840f2b47e56ce758126dfb661048f95e34fdcece36c685f009bc9dbf34cde6dff89a8034a5093145aa6434504
-
\Users\Admin\AppData\Local\gZC\TAPI32.dllMD5
68384c06f836614dc416891bee821833
SHA1b6c7f82632f140990c6d6dac76dd64e00b04ca12
SHA256eed751952469985cd50b3d061530a04d2fe1a45a13c6b527803f4ba9e257200e
SHA51299e71bec9cceb2559a72f057aa01f7383ba4c3c89ec1d04459e55cc2ffa19e5c9d43f6376efaa27b86521f57fd563aa179c2587e83c07c7a5c042eab91d19393
-
memory/1920-151-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-161-0x00007FF8B5A20000-0x00007FF8B5A22000-memory.dmpFilesize
8KB
-
memory/1920-132-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-134-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-133-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-135-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-136-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-137-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-138-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-139-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-141-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-140-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-143-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-142-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-144-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-145-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-146-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-147-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-148-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-149-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-150-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-195-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1920-152-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-158-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1920-157-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1920-159-0x00007FF8B58E5000-0x00007FF8B58E6000-memory.dmpFilesize
4KB
-
memory/1920-160-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1920-131-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-125-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/1920-130-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-129-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-127-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-128-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1920-126-0x0000000140000000-0x0000000140156000-memory.dmpFilesize
1.3MB
-
memory/1984-162-0x0000000000000000-mapping.dmp
-
memory/1984-172-0x000002E32FB00000-0x000002E32FB02000-memory.dmpFilesize
8KB
-
memory/1984-171-0x000002E32FB00000-0x000002E32FB02000-memory.dmpFilesize
8KB
-
memory/1984-170-0x000002E32FB00000-0x000002E32FB02000-memory.dmpFilesize
8KB
-
memory/1984-166-0x00007FF8A94E0000-0x00007FF8A9638000-memory.dmpFilesize
1.3MB
-
memory/2716-122-0x0000025F186A0000-0x0000025F186A2000-memory.dmpFilesize
8KB
-
memory/2716-118-0x00007FF8A94E0000-0x00007FF8A9636000-memory.dmpFilesize
1.3MB
-
memory/2716-124-0x0000025F185F0000-0x0000025F185F7000-memory.dmpFilesize
28KB
-
memory/2716-123-0x0000025F186A0000-0x0000025F186A2000-memory.dmpFilesize
8KB
-
memory/2860-188-0x00007FF8A94E0000-0x00007FF8A9637000-memory.dmpFilesize
1.3MB
-
memory/2860-194-0x000002311CDB0000-0x000002311CDB2000-memory.dmpFilesize
8KB
-
memory/2860-193-0x000002311CDB0000-0x000002311CDB2000-memory.dmpFilesize
8KB
-
memory/2860-184-0x0000000000000000-mapping.dmp
-
memory/2860-192-0x000002311CDB0000-0x000002311CDB2000-memory.dmpFilesize
8KB
-
memory/3952-183-0x000001957BE80000-0x000001957BE82000-memory.dmpFilesize
8KB
-
memory/3952-173-0x0000000000000000-mapping.dmp
-
memory/3952-177-0x00007FF8A94A0000-0x00007FF8A963C000-memory.dmpFilesize
1.6MB
-
memory/3952-182-0x000001957BE80000-0x000001957BE82000-memory.dmpFilesize
8KB
-
memory/3952-181-0x000001957BE80000-0x000001957BE82000-memory.dmpFilesize
8KB