Analysis
-
max time kernel
154s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
26-11-2021 09:29
Static task
static1
Behavioral task
behavioral1
Sample
64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92.dll
Resource
win7-en-20211104
General
-
Target
64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92.dll
-
Size
1.3MB
-
MD5
e57e81a28fe78e44bb3ff92b0aa211b0
-
SHA1
087ff74a9232abeabe0bdfd835690820fa990718
-
SHA256
64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92
-
SHA512
fb6451f71a29ba074c500cc9328503ab33d38f55536e50c3abcf0a78b8917520d0530c132c20c15f02083469504f73fb3416d6a3068fc32ba9ee5c0ed8ea5688
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1208-60-0x0000000002220000-0x0000000002221000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
OptionalFeatures.exewusa.exeMagnify.exepid process 1300 OptionalFeatures.exe 1064 wusa.exe 1400 Magnify.exe -
Loads dropped DLL 7 IoCs
Processes:
OptionalFeatures.exewusa.exeMagnify.exepid process 1208 1300 OptionalFeatures.exe 1208 1064 wusa.exe 1208 1400 Magnify.exe 1208 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Myzdcwow = "C:\\Users\\Admin\\AppData\\Roaming\\MEDIAC~1\\DPA8DC~1\\wusa.exe" -
Processes:
OptionalFeatures.exewusa.exeMagnify.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OptionalFeatures.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wusa.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Magnify.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 684 regsvr32.exe 684 regsvr32.exe 684 regsvr32.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
Processes:
regsvr32.exeOptionalFeatures.exewusa.exeMagnify.exepid process 684 regsvr32.exe 1208 1300 OptionalFeatures.exe 1064 wusa.exe 1400 Magnify.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid process target process PID 1208 wrote to memory of 1304 1208 OptionalFeatures.exe PID 1208 wrote to memory of 1304 1208 OptionalFeatures.exe PID 1208 wrote to memory of 1304 1208 OptionalFeatures.exe PID 1208 wrote to memory of 1300 1208 OptionalFeatures.exe PID 1208 wrote to memory of 1300 1208 OptionalFeatures.exe PID 1208 wrote to memory of 1300 1208 OptionalFeatures.exe PID 1208 wrote to memory of 828 1208 wusa.exe PID 1208 wrote to memory of 828 1208 wusa.exe PID 1208 wrote to memory of 828 1208 wusa.exe PID 1208 wrote to memory of 1064 1208 wusa.exe PID 1208 wrote to memory of 1064 1208 wusa.exe PID 1208 wrote to memory of 1064 1208 wusa.exe PID 1208 wrote to memory of 992 1208 Magnify.exe PID 1208 wrote to memory of 992 1208 Magnify.exe PID 1208 wrote to memory of 992 1208 Magnify.exe PID 1208 wrote to memory of 1400 1208 Magnify.exe PID 1208 wrote to memory of 1400 1208 Magnify.exe PID 1208 wrote to memory of 1400 1208 Magnify.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\4fdcv9c\OptionalFeatures.exeC:\Users\Admin\AppData\Local\4fdcv9c\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\iodhsU5dq\wusa.exeC:\Users\Admin\AppData\Local\iodhsU5dq\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\6thnjqH5\Magnify.exeC:\Users\Admin\AppData\Local\6thnjqH5\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\4fdcv9c\OptionalFeatures.exeMD5
eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
C:\Users\Admin\AppData\Local\4fdcv9c\appwiz.cplMD5
a192cac6b4117caa95c757528cf4ef93
SHA1cd38779e00af50fb88253bff2b11770fb0a23494
SHA256d2c229bd70025b7448af0c1e209a49a739df71f67e2e377380d9ae0a6d610c07
SHA512cbd0d4590cafe9b16c25e7e5fdd581c08cfc92e6f90a71b34215cc370f5a27002fb342b7a9ed43a9cab6e4ea255e4064da6f14640c0950623fff03e338b869d9
-
C:\Users\Admin\AppData\Local\6thnjqH5\Magnify.exeMD5
233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
C:\Users\Admin\AppData\Local\6thnjqH5\OLEACC.dllMD5
86f3695f6faf81fa094166ce0e4ce9a3
SHA1e2edbf0c6234c4aa329e31b352fb7903523e4406
SHA256adfb9fbd9fd24753f0553a57bcbf837333de10b0648c9fed37183cbad32ef010
SHA5125c6c9d9dc80c55e36a607d8933b585ff8588a3145b6410cb53966d4735229d4a7248f9ec5a1a65de64abf55cc2043059330e3cf7aea1557bb5f8090e596d404f
-
C:\Users\Admin\AppData\Local\iodhsU5dq\dpx.dllMD5
477ab349446a6eef993bef28419fc090
SHA1cfc4ad89b57df3302bcc26c3497c4908a2167bb1
SHA256e640f2cbb64ad3e4a95b04c723ff877154dc409a724ff399bfb80530e29ad085
SHA512b47920c03fc56cb0ec1a380be0b41513298d7115d721de815e09bdf6dc75d5fc47e12f217aca1cd108c0ceaa5a307b10d4c7a105f79d5cde888bc0498bea0ece
-
C:\Users\Admin\AppData\Local\iodhsU5dq\wusa.exeMD5
c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
\Users\Admin\AppData\Local\4fdcv9c\OptionalFeatures.exeMD5
eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
\Users\Admin\AppData\Local\4fdcv9c\appwiz.cplMD5
a192cac6b4117caa95c757528cf4ef93
SHA1cd38779e00af50fb88253bff2b11770fb0a23494
SHA256d2c229bd70025b7448af0c1e209a49a739df71f67e2e377380d9ae0a6d610c07
SHA512cbd0d4590cafe9b16c25e7e5fdd581c08cfc92e6f90a71b34215cc370f5a27002fb342b7a9ed43a9cab6e4ea255e4064da6f14640c0950623fff03e338b869d9
-
\Users\Admin\AppData\Local\6thnjqH5\Magnify.exeMD5
233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
\Users\Admin\AppData\Local\6thnjqH5\OLEACC.dllMD5
86f3695f6faf81fa094166ce0e4ce9a3
SHA1e2edbf0c6234c4aa329e31b352fb7903523e4406
SHA256adfb9fbd9fd24753f0553a57bcbf837333de10b0648c9fed37183cbad32ef010
SHA5125c6c9d9dc80c55e36a607d8933b585ff8588a3145b6410cb53966d4735229d4a7248f9ec5a1a65de64abf55cc2043059330e3cf7aea1557bb5f8090e596d404f
-
\Users\Admin\AppData\Local\iodhsU5dq\dpx.dllMD5
477ab349446a6eef993bef28419fc090
SHA1cfc4ad89b57df3302bcc26c3497c4908a2167bb1
SHA256e640f2cbb64ad3e4a95b04c723ff877154dc409a724ff399bfb80530e29ad085
SHA512b47920c03fc56cb0ec1a380be0b41513298d7115d721de815e09bdf6dc75d5fc47e12f217aca1cd108c0ceaa5a307b10d4c7a105f79d5cde888bc0498bea0ece
-
\Users\Admin\AppData\Local\iodhsU5dq\wusa.exeMD5
c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Ku0B\Magnify.exeMD5
233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
memory/684-55-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmpFilesize
8KB
-
memory/684-59-0x0000000000100000-0x0000000000107000-memory.dmpFilesize
28KB
-
memory/684-56-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1064-90-0x0000000000000000-mapping.dmp
-
memory/1208-73-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-71-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-63-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-60-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/1208-64-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-65-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-66-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-67-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-70-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-80-0x0000000077020000-0x0000000077022000-memory.dmpFilesize
8KB
-
memory/1208-72-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-74-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-68-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-69-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-61-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1208-62-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/1300-82-0x0000000000000000-mapping.dmp
-
memory/1400-99-0x0000000000000000-mapping.dmp
-
memory/1400-104-0x0000000140000000-0x000000014014C000-memory.dmpFilesize
1.3MB