Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
6562aa0b5ce1d60fdd3356b1814d1990da8c53e063b49b873b54184c6cac8e3a.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
6562aa0b5ce1d60fdd3356b1814d1990da8c53e063b49b873b54184c6cac8e3a.dll
-
Size
972KB
-
MD5
c13dbdfb58da48769cfe6bc96bd0403f
-
SHA1
caea0f4ffb19467c3dbe94b2f677bf851f690c00
-
SHA256
6562aa0b5ce1d60fdd3356b1814d1990da8c53e063b49b873b54184c6cac8e3a
-
SHA512
0d829f832d5797c429defd3d67585e8d83aae588ecb1dfdd3fb864ec43bcf4a990a79492af329bdaff99c4382b11fd501a0dfc64e520d8239f22c0bb53b0c96b
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1232-59-0x00000000029C0000-0x00000000029C1000-memory.dmp dridex_stager_shellcode -
Modifies Installed Components in the registry 2 TTPs
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
rundll32.exepid process 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe Token: 33 1568 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1568 AUDIODG.EXE Token: 33 1568 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1568 AUDIODG.EXE Token: SeShutdownPrivilege 1736 explorer.exe Token: SeShutdownPrivilege 1736 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
explorer.exepid process 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe 1736 explorer.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6562aa0b5ce1d60fdd3356b1814d1990da8c53e063b49b873b54184c6cac8e3a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5881⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-54-0x0000000140000000-0x00000001400FB000-memory.dmpFilesize
1004KB
-
memory/976-58-0x0000000000190000-0x0000000000197000-memory.dmpFilesize
28KB
-
memory/1232-59-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/1736-60-0x000007FEFC3B1000-0x000007FEFC3B3000-memory.dmpFilesize
8KB