Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
9496ab1084d795dec40c7033b9ca84335347b3c45491e2ba3da457bd2088a053.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9496ab1084d795dec40c7033b9ca84335347b3c45491e2ba3da457bd2088a053.dll
Resource
win10v2004-20220414-en
General
-
Target
9496ab1084d795dec40c7033b9ca84335347b3c45491e2ba3da457bd2088a053.dll
-
Size
1.4MB
-
MD5
1ac4db4a4dcdf80d076fadd6f0047bc0
-
SHA1
8afc736ef712c980d04b45c539f72e4f3dedbdf4
-
SHA256
9496ab1084d795dec40c7033b9ca84335347b3c45491e2ba3da457bd2088a053
-
SHA512
6d61d7ef13757472e9417577fd225fb966dc8be12c7a6e028a9bc84f069a0af277fa6734610393a93c3351dda8f354e0fd33ef042ce5ff5503216ab16557998c
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1204-60-0x0000000002910000-0x0000000002911000-memory.dmp dridex_stager_shellcode -
Modifies Installed Components in the registry 2 TTPs
-
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exepid process 1592 regsvr32.exe 1592 regsvr32.exe 1592 regsvr32.exe 1592 regsvr32.exe 1592 regsvr32.exe 1592 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe Token: 33 656 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 656 AUDIODG.EXE Token: 33 656 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 656 AUDIODG.EXE Token: SeShutdownPrivilege 2032 explorer.exe Token: SeShutdownPrivilege 2032 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9496ab1084d795dec40c7033b9ca84335347b3c45491e2ba3da457bd2088a053.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-60-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/1592-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmpFilesize
8KB
-
memory/1592-55-0x0000000140000000-0x0000000140176000-memory.dmpFilesize
1.5MB
-
memory/1592-59-0x0000000000120000-0x0000000000127000-memory.dmpFilesize
28KB