Overview

overview

6

Static

static

dridex

windows10_x64

6

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    04-01-2022 14:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4ec9be8e93dd3f6f48db661592ad6a96ffde8827a7a30362eec06232d9b8da5.exe

  • Size

    4.0MB

  • MD5

    627914078afb6e8601c91fc8552887bc

  • SHA1

    7e149639e304024e895b2ce7a35a1626abf084f2

  • SHA256

    b4ec9be8e93dd3f6f48db661592ad6a96ffde8827a7a30362eec06232d9b8da5

  • SHA512

    52dd6dcfc9d70c8d4fa47c589fc54d939277bcf2fc1989efb8830384b2bce2ebca4ad28c347e2339783f4c4d86edbade9c4a5d3487daa885310db5d7f61883b8

Score
6/10
ransomware

Malware Config

Signatures

  • Drops desktop.ini file(s) 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4ec9be8e93dd3f6f48db661592ad6a96ffde8827a7a30362eec06232d9b8da5.exe
    "C:\Users\Admin\AppData\Local\Temp\b4ec9be8e93dd3f6f48db661592ad6a96ffde8827a7a30362eec06232d9b8da5.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_²¡Ãû¤ÏÛ¤À¤Ã¤¿_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:2368
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:960

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2361464256-2201551969-2316606395-1000\desktop.ini
      MD5

      a526b9e7c716b3489d8cc062fbce4005

      SHA1

      2df502a944ff721241be20a9e449d2acd07e0312

      SHA256

      e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

      SHA512

      d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

      Download Submit
    • C:\Users\Admin\Desktop\_²¡Ãû¤ÏÛ¤À¤Ã¤¿_.hta
      MD5

      468aafe85a8944334c1a4374695d0663

      SHA1

      43f211080b8cf2f56eb3dbffda47fa7d4d6fff9e

      SHA256

      d74ff56df07ea8a1a0c8359f928e80ce6743103d52cf08ff9908028ab978411d

      SHA512

      e76c9b7988552c1f46ab3a81f9cb3124f276147e25ecd08757988683868b5ec326ee94fa591fad678da5bd69fc264761c017cf482cee7a95b181170ea29f3464

      Download Submit
    • memory/960-121-0x000002550DE40000-0x000002550DE42000-memory.dmp
      Filesize

      8KB

      Download
    • memory/960-122-0x000002550DE40000-0x000002550DE42000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1016-118-0x0000000003C20000-0x0000000003C30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1016-119-0x0000000003C20000-0x0000000003C30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1016-120-0x0000000003C20000-0x0000000003C30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1016-123-0x0000000003C20000-0x0000000003C30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1016-124-0x0000000003C20000-0x0000000003C30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2368-116-0x0000000000000000-mapping.dmp
      Download