Analysis
-
max time kernel
156s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
19-03-2022 08:32
Static task
static1
Behavioral task
behavioral1
Sample
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
Resource
win7-20220311-en
General
-
Target
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
-
Size
636KB
-
MD5
783be6458fd27d5ee223d3b9e4c4b9b1
-
SHA1
0e8b1bc64e8d2d78b2fa7125e5e74f1fe660b418
-
SHA256
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834
-
SHA512
bf1c755f31b9a512b6aa171e9e62ab744ab131edd7166ddc5268231e45076a9fd4831fb2a68696da7961f16b13e4df6daa39fc8d43cb9cc27d32888ec5952d6c
Malware Config
Extracted
dridex
10111
212.129.24.83:3889
195.159.28.230:4443
208.71.173.207:3098
162.144.127.197:3786
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{848D70C1-A828-43DC-BC07-6596428F06C7}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A9075903-13F7-4496-88F9-5E411CFC1D95}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exepid process 4200 cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe"C:\Users\Admin\AppData\Local\Temp\cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry