Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce.dll
Resource
win7-20220414-en
General
-
Target
751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce.dll
-
Size
969KB
-
MD5
62b5ce1d64dcb1b9f0c825ba62996856
-
SHA1
5e7eea97f2c31a0ef3b2feb5c9de45a3869f63c0
-
SHA256
751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce
-
SHA512
fe1698172d163b1c1efe802ec0d573a492aa2c1cbb15b60d2c9b69ca0158205812d875180866e4cff8570dff45663eb85457fb0e48bbec99bbc8c570af87c7e3
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1232-59-0x00000000029E0000-0x00000000029E1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
mspaint.exeRDVGHelper.exeiexpress.exepid process 1272 mspaint.exe 1440 RDVGHelper.exe 1660 iexpress.exe -
Loads dropped DLL 7 IoCs
Processes:
mspaint.exeRDVGHelper.exeiexpress.exepid process 1232 1272 mspaint.exe 1232 1440 RDVGHelper.exe 1232 1660 iexpress.exe 1232 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Evgmngveltmlhb = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\BudIm2DFl9\\RDVGHelper.exe" -
Processes:
rundll32.exemspaint.exeRDVGHelper.exeiexpress.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mspaint.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RDVGHelper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexpress.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exemspaint.exepid process 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1272 mspaint.exe 1272 mspaint.exe 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid process target process PID 1232 wrote to memory of 580 1232 mspaint.exe PID 1232 wrote to memory of 580 1232 mspaint.exe PID 1232 wrote to memory of 580 1232 mspaint.exe PID 1232 wrote to memory of 1272 1232 mspaint.exe PID 1232 wrote to memory of 1272 1232 mspaint.exe PID 1232 wrote to memory of 1272 1232 mspaint.exe PID 1232 wrote to memory of 1228 1232 RDVGHelper.exe PID 1232 wrote to memory of 1228 1232 RDVGHelper.exe PID 1232 wrote to memory of 1228 1232 RDVGHelper.exe PID 1232 wrote to memory of 1440 1232 RDVGHelper.exe PID 1232 wrote to memory of 1440 1232 RDVGHelper.exe PID 1232 wrote to memory of 1440 1232 RDVGHelper.exe PID 1232 wrote to memory of 520 1232 iexpress.exe PID 1232 wrote to memory of 520 1232 iexpress.exe PID 1232 wrote to memory of 520 1232 iexpress.exe PID 1232 wrote to memory of 1660 1232 iexpress.exe PID 1232 wrote to memory of 1660 1232 iexpress.exe PID 1232 wrote to memory of 1660 1232 iexpress.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\tkdfz23n4\mspaint.exeC:\Users\Admin\AppData\Local\tkdfz23n4\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RDVGHelper.exeC:\Windows\system32\RDVGHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\DTN\RDVGHelper.exeC:\Users\Admin\AppData\Local\DTN\RDVGHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\Fjrh\iexpress.exeC:\Users\Admin\AppData\Local\Fjrh\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\DTN\RDVGHelper.exeFilesize
93KB
MD553fda4af81e7c4895357a50e848b7cfe
SHA101fb2d0210f1c47aaf684e31a9fb78f89bba9c0f
SHA25662ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038
SHA512dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051
-
C:\Users\Admin\AppData\Local\DTN\dwmapi.dllFilesize
971KB
MD59dd39bf7d96ff19760e45a9076490cc9
SHA1162ec133203021f93310a2b669d62fbc2126e2d8
SHA256b6f8373c51ab2b958b7cb6e92e3a072a0d4e255d467bd4ee290042c89c4b454e
SHA5125e934f6ca071425e79bf6495e204c613adb30aa6785adc4d5896c90015b2e93b4ce2b62867105201a07cfb7f1a8190aceade535d643a2d283db5534c24248221
-
C:\Users\Admin\AppData\Local\Fjrh\VERSION.dllFilesize
970KB
MD587a935f379e06f1f5ee419ebcc3d62af
SHA1fc578491744a2a560cdf648019d8bf2be57d8d67
SHA256fbdb82aa505b01bd916c800a666da166516cb1116cd89cba42cfa32ad3398f38
SHA51291b7f5202c7c5415ef8941e53321ebea87b1f518545677fe56da7f2384307b41bbdd0e68d3655abeb6e71382fa12ff8ce96a00a4be0469040fbf6f0ff49c293b
-
C:\Users\Admin\AppData\Local\Fjrh\iexpress.exeFilesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
C:\Users\Admin\AppData\Local\tkdfz23n4\VERSION.dllFilesize
970KB
MD53f21e93c9d84164de12f575c4d037543
SHA1a5505604beac6cdfd3f467b03bcfaf56ce2ea0e5
SHA256d89ca878bd32da341716b3a6ec98fbb725f510ba6f886aa3fb809ad7a4a414c0
SHA51293dca310b8e7020680b59dccb5edd1768a882ccfbc9697cb00a02454276da377827f2426df3066cdc65a60b14af4f2127134a3f8c504c1a601e88e841ea0495d
-
C:\Users\Admin\AppData\Local\tkdfz23n4\mspaint.exeFilesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
\Users\Admin\AppData\Local\DTN\RDVGHelper.exeFilesize
93KB
MD553fda4af81e7c4895357a50e848b7cfe
SHA101fb2d0210f1c47aaf684e31a9fb78f89bba9c0f
SHA25662ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038
SHA512dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051
-
\Users\Admin\AppData\Local\DTN\dwmapi.dllFilesize
971KB
MD59dd39bf7d96ff19760e45a9076490cc9
SHA1162ec133203021f93310a2b669d62fbc2126e2d8
SHA256b6f8373c51ab2b958b7cb6e92e3a072a0d4e255d467bd4ee290042c89c4b454e
SHA5125e934f6ca071425e79bf6495e204c613adb30aa6785adc4d5896c90015b2e93b4ce2b62867105201a07cfb7f1a8190aceade535d643a2d283db5534c24248221
-
\Users\Admin\AppData\Local\Fjrh\VERSION.dllFilesize
970KB
MD587a935f379e06f1f5ee419ebcc3d62af
SHA1fc578491744a2a560cdf648019d8bf2be57d8d67
SHA256fbdb82aa505b01bd916c800a666da166516cb1116cd89cba42cfa32ad3398f38
SHA51291b7f5202c7c5415ef8941e53321ebea87b1f518545677fe56da7f2384307b41bbdd0e68d3655abeb6e71382fa12ff8ce96a00a4be0469040fbf6f0ff49c293b
-
\Users\Admin\AppData\Local\Fjrh\iexpress.exeFilesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
\Users\Admin\AppData\Local\tkdfz23n4\VERSION.dllFilesize
970KB
MD53f21e93c9d84164de12f575c4d037543
SHA1a5505604beac6cdfd3f467b03bcfaf56ce2ea0e5
SHA256d89ca878bd32da341716b3a6ec98fbb725f510ba6f886aa3fb809ad7a4a414c0
SHA51293dca310b8e7020680b59dccb5edd1768a882ccfbc9697cb00a02454276da377827f2426df3066cdc65a60b14af4f2127134a3f8c504c1a601e88e841ea0495d
-
\Users\Admin\AppData\Local\tkdfz23n4\mspaint.exeFilesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\2K9uy\iexpress.exeFilesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
memory/1048-54-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1048-58-0x0000000000290000-0x0000000000297000-memory.dmpFilesize
28KB
-
memory/1232-64-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-79-0x0000000001DD0000-0x0000000001DD7000-memory.dmpFilesize
28KB
-
memory/1232-60-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-80-0x00000000779A0000-0x00000000779A2000-memory.dmpFilesize
8KB
-
memory/1232-66-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-65-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-63-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-62-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-59-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/1232-61-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-67-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-68-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-70-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1232-69-0x0000000140000000-0x00000001400FA000-memory.dmpFilesize
1000KB
-
memory/1272-84-0x000007FEFC041000-0x000007FEFC043000-memory.dmpFilesize
8KB
-
memory/1272-91-0x0000000000190000-0x0000000000197000-memory.dmpFilesize
28KB
-
memory/1272-87-0x0000000140000000-0x00000001400FB000-memory.dmpFilesize
1004KB
-
memory/1272-82-0x0000000000000000-mapping.dmp
-
memory/1440-101-0x0000000000170000-0x0000000000177000-memory.dmpFilesize
28KB
-
memory/1440-93-0x0000000000000000-mapping.dmp
-
memory/1660-103-0x0000000000000000-mapping.dmp
-
memory/1660-111-0x0000000000270000-0x0000000000277000-memory.dmpFilesize
28KB