Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
26-11-2021 09:32
Static task
static1
Behavioral task
behavioral1
Sample
b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79.dll
Resource
win7-en-20211104
General
-
Target
b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79.dll
-
Size
1.2MB
-
MD5
12a2429bc9990f1631ce12341895db8c
-
SHA1
0ee8f6d9b2ce34403e841a39a5f92c6d8138dc42
-
SHA256
b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79
-
SHA512
cd85e51fe53befd08ce8707d354ba2a1e519dc5444cc81dd625342af64de9f93de947dcb845c652ad13012c22e056851d2c11eb236086607560e16b829f0a8df
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3024-122-0x0000000000790000-0x0000000000791000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 4 IoCs
Processes:
msinfo32.exeFileHistory.exeBitLockerWizardElev.exeWFS.exepid process 2088 msinfo32.exe 1780 FileHistory.exe 780 BitLockerWizardElev.exe 2012 WFS.exe -
Loads dropped DLL 4 IoCs
Processes:
msinfo32.exeFileHistory.exeBitLockerWizardElev.exeWFS.exepid process 2088 msinfo32.exe 1780 FileHistory.exe 780 BitLockerWizardElev.exe 2012 WFS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Slqggwbvaxk = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\NETWOR~1\\hzKDvlss\\BITLOC~1.EXE" -
Processes:
BitLockerWizardElev.exeWFS.exerundll32.exemsinfo32.exeFileHistory.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BitLockerWizardElev.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WFS.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msinfo32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FileHistory.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exemsinfo32.exepid process 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 2088 msinfo32.exe 2088 msinfo32.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
description pid process target process PID 3024 wrote to memory of 2904 3024 msinfo32.exe PID 3024 wrote to memory of 2904 3024 msinfo32.exe PID 3024 wrote to memory of 2088 3024 msinfo32.exe PID 3024 wrote to memory of 2088 3024 msinfo32.exe PID 3024 wrote to memory of 3960 3024 FileHistory.exe PID 3024 wrote to memory of 3960 3024 FileHistory.exe PID 3024 wrote to memory of 1780 3024 FileHistory.exe PID 3024 wrote to memory of 1780 3024 FileHistory.exe PID 3024 wrote to memory of 3776 3024 BitLockerWizardElev.exe PID 3024 wrote to memory of 3776 3024 BitLockerWizardElev.exe PID 3024 wrote to memory of 780 3024 BitLockerWizardElev.exe PID 3024 wrote to memory of 780 3024 BitLockerWizardElev.exe PID 3024 wrote to memory of 2444 3024 WFS.exe PID 3024 wrote to memory of 2444 3024 WFS.exe PID 3024 wrote to memory of 2012 3024 WFS.exe PID 3024 wrote to memory of 2012 3024 WFS.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\6uzQag\msinfo32.exeC:\Users\Admin\AppData\Local\6uzQag\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FileHistory.exeC:\Windows\system32\FileHistory.exe1⤵
-
C:\Users\Admin\AppData\Local\zO0KSEV\FileHistory.exeC:\Users\Admin\AppData\Local\zO0KSEV\FileHistory.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\uvFf\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\uvFf\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\hEVS\WFS.exeC:\Users\Admin\AppData\Local\hEVS\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\6uzQag\SLC.dllMD5
7309d634d88be93d2cb6a99b81892bf5
SHA18a5a2a0e3e713eb7979e4972b6adb0c895360629
SHA2569fd28169ff934cf4c9c0b9452d1d0179cbcab15c66056d8bfe1fbc6b029e432f
SHA5128cd3885aec475879316a4ebeda039109b39ab65dadfed6632d80f6bc1549b1c87707d6ae2a4a96109e937b61feec4861aaf2f65f7413c14c20dcc03b7d1af755
-
C:\Users\Admin\AppData\Local\6uzQag\msinfo32.exeMD5
255861c59cdfbf86c03560d39a92932a
SHA118353cb8a58d25ab62687b69fee44d007b994f19
SHA25657aeba5f7f9de579f3c334e7e013114f6b2257b810b2fc8c1f96331ad1c4909c
SHA512f695394f344f07036684dc4ba4ba011bc0b5b0b27898c82714cbd072c6218870234deb18044c00bf3fda618480e4e517cba50d577c228a63ee3e2676029e430b
-
C:\Users\Admin\AppData\Local\hEVS\MFC42u.dllMD5
15d96b08ac21db48ff9f23e97ea68629
SHA155197b57cb93da95c8f2a78ee29349fa1acba517
SHA256e16f470dfc66ef23c62174d3cd07e994670577d2d7d6bc8577dfcf20e4e402fa
SHA5126340808d958f2ddee72e2b1fadfee9cad7858653266a433f875bcd5552c7184cff7acf7b3f11bbcaa8cc6fb75b97e4463579d9b2ad0f2d48ec1d3b64d7c2088b
-
C:\Users\Admin\AppData\Local\hEVS\WFS.exeMD5
f5c1b5e7334f4a7fa393cc68f16eab93
SHA1d17180a8f7be23ebdf04162a8c66a9c3bb18d9c1
SHA25668b593b074f7501cee6a7af0d006a611f413a0d4f22b43c041fcec3815112208
SHA5123656d43322e9ed1da68ff58deeb458c3633c693b1e9b79fc7c557166db6af8cb7d155341742510cf803aeb985dd825c64ecfaa7eda7ccf0952dcb06249a92fc0
-
C:\Users\Admin\AppData\Local\uvFf\BitLockerWizardElev.exeMD5
43d63950e411885e21eeb33a7f33dc85
SHA1aa5489c400ae898ba8590e7198846ca51d4ae872
SHA25682f381697c3ea8df147de184892751a5c99475617c245b3caece870bb0a5418a
SHA51265b87ecb21289f3ce72f8ea00e877f6023551d4ba5f62e27ac00df7376c1f1d3d612419fac54211a91383b016e03a7f82ac8bc0beaa10262767538dba09423ca
-
C:\Users\Admin\AppData\Local\uvFf\FVEWIZ.dllMD5
4b0e19b3f92927f6a7d4432ab1007833
SHA15355f8d17dfeb87f2d8856206cec84f4d49f39b8
SHA256c5a7060ab70b69fb24ae599bb349d38383f1c3093048ebd350348eca1f6abf26
SHA512ac2b5f11987e842d16d33a5b28bff15796c604dca8952419c2d8c2e3c4a2795b829df6ec2bc0c3c47205fef26dd4eb39f69a2d66799ccdd060ed36a0984feae3
-
C:\Users\Admin\AppData\Local\zO0KSEV\FileHistory.exeMD5
2735b1264f7cb991b3f0d8b5c98b456f
SHA12e26a23c047632e985ea9bc64e92687930828156
SHA256ca54111e88b368c117fe3168dddb5f383b17beac9290ee35d19cd307060d46e9
SHA512e869426232e2f2bfab72d041423703d293674fd9b3519a0254bee6eacccecb9626398f7eeaeefbcf887a1524d0fb53c6209038b0faeab800b00a766f39e4a816
-
C:\Users\Admin\AppData\Local\zO0KSEV\FileHistory.exeMD5
2735b1264f7cb991b3f0d8b5c98b456f
SHA12e26a23c047632e985ea9bc64e92687930828156
SHA256ca54111e88b368c117fe3168dddb5f383b17beac9290ee35d19cd307060d46e9
SHA512e869426232e2f2bfab72d041423703d293674fd9b3519a0254bee6eacccecb9626398f7eeaeefbcf887a1524d0fb53c6209038b0faeab800b00a766f39e4a816
-
C:\Users\Admin\AppData\Local\zO0KSEV\UxTheme.dllMD5
71d3dbd1842319a35e096b0cd4469e13
SHA17c78872c86b8862840fc9a2ac0e9971f3927b17b
SHA2562e8785619ba2372e71fbaf1a041d39039a14e4e34e69ae18b82a41c5e8ea6dce
SHA512570ee41cedcbe5404aea29e62d8377f6e44e341633a4589c7a57c76278c0b9522e76a9ce19564b11538661d1651abbbef939c7a83c2a90fd5366eed131048d36
-
\Users\Admin\AppData\Local\6uzQag\SLC.dllMD5
7309d634d88be93d2cb6a99b81892bf5
SHA18a5a2a0e3e713eb7979e4972b6adb0c895360629
SHA2569fd28169ff934cf4c9c0b9452d1d0179cbcab15c66056d8bfe1fbc6b029e432f
SHA5128cd3885aec475879316a4ebeda039109b39ab65dadfed6632d80f6bc1549b1c87707d6ae2a4a96109e937b61feec4861aaf2f65f7413c14c20dcc03b7d1af755
-
\Users\Admin\AppData\Local\hEVS\MFC42u.dllMD5
15d96b08ac21db48ff9f23e97ea68629
SHA155197b57cb93da95c8f2a78ee29349fa1acba517
SHA256e16f470dfc66ef23c62174d3cd07e994670577d2d7d6bc8577dfcf20e4e402fa
SHA5126340808d958f2ddee72e2b1fadfee9cad7858653266a433f875bcd5552c7184cff7acf7b3f11bbcaa8cc6fb75b97e4463579d9b2ad0f2d48ec1d3b64d7c2088b
-
\Users\Admin\AppData\Local\uvFf\FVEWIZ.dllMD5
4b0e19b3f92927f6a7d4432ab1007833
SHA15355f8d17dfeb87f2d8856206cec84f4d49f39b8
SHA256c5a7060ab70b69fb24ae599bb349d38383f1c3093048ebd350348eca1f6abf26
SHA512ac2b5f11987e842d16d33a5b28bff15796c604dca8952419c2d8c2e3c4a2795b829df6ec2bc0c3c47205fef26dd4eb39f69a2d66799ccdd060ed36a0984feae3
-
\Users\Admin\AppData\Local\zO0KSEV\UxTheme.dllMD5
71d3dbd1842319a35e096b0cd4469e13
SHA17c78872c86b8862840fc9a2ac0e9971f3927b17b
SHA2562e8785619ba2372e71fbaf1a041d39039a14e4e34e69ae18b82a41c5e8ea6dce
SHA512570ee41cedcbe5404aea29e62d8377f6e44e341633a4589c7a57c76278c0b9522e76a9ce19564b11538661d1651abbbef939c7a83c2a90fd5366eed131048d36
-
memory/780-181-0x00007FFA8B310000-0x00007FFA8B43C000-memory.dmpFilesize
1.2MB
-
memory/780-185-0x0000016CB6EF0000-0x0000016CB6EF2000-memory.dmpFilesize
8KB
-
memory/780-177-0x0000000000000000-mapping.dmp
-
memory/780-186-0x0000016CB6EF0000-0x0000016CB6EF2000-memory.dmpFilesize
8KB
-
memory/780-187-0x0000016CB6EF0000-0x0000016CB6EF2000-memory.dmpFilesize
8KB
-
memory/1780-167-0x0000000000000000-mapping.dmp
-
memory/1780-171-0x00007FFA8B2A0000-0x00007FFA8B3CC000-memory.dmpFilesize
1.2MB
-
memory/1780-176-0x00007FF7F74C0000-0x00007FF7F74C1000-memory.dmpFilesize
4KB
-
memory/2012-188-0x0000000000000000-mapping.dmp
-
memory/2012-192-0x00007FFA8B180000-0x00007FFA8B2B2000-memory.dmpFilesize
1.2MB
-
memory/2012-197-0x000001D5B5E60000-0x000001D5B5E62000-memory.dmpFilesize
8KB
-
memory/2012-196-0x000001D5B5E60000-0x000001D5B5E62000-memory.dmpFilesize
8KB
-
memory/2088-155-0x0000000000000000-mapping.dmp
-
memory/2088-166-0x0000027B59860000-0x0000027B59862000-memory.dmpFilesize
8KB
-
memory/2088-165-0x0000027B59860000-0x0000027B59862000-memory.dmpFilesize
8KB
-
memory/2088-164-0x0000027B59860000-0x0000027B59862000-memory.dmpFilesize
8KB
-
memory/2088-160-0x00007FFA8B1A0000-0x00007FFA8B2CC000-memory.dmpFilesize
1.2MB
-
memory/3024-134-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-135-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-154-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/3024-152-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/3024-151-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/3024-146-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-145-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-159-0x00007FFA99030000-0x00007FFA99040000-memory.dmpFilesize
64KB
-
memory/3024-144-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-143-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-142-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-141-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-140-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-139-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-138-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-137-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-136-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-153-0x00007FFA99115000-0x00007FFA99116000-memory.dmpFilesize
4KB
-
memory/3024-122-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/3024-133-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-132-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-131-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-130-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-129-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-128-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-127-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-126-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-125-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-123-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3024-124-0x0000000140000000-0x000000014012B000-memory.dmpFilesize
1.2MB
-
memory/3168-115-0x00007FFA8B310000-0x00007FFA8B43B000-memory.dmpFilesize
1.2MB
-
memory/3168-121-0x0000020F69F80000-0x0000020F69F87000-memory.dmpFilesize
28KB
-
memory/3168-120-0x0000020F69F90000-0x0000020F69F92000-memory.dmpFilesize
8KB
-
memory/3168-119-0x0000020F69F90000-0x0000020F69F92000-memory.dmpFilesize
8KB