Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe
Resource
win7-20220812-en
General
-
Target
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe
-
Size
159KB
-
MD5
72fe19810a9089cd1ec3ac5ddda22d3f
-
SHA1
cecbd09b389a6f4e3ac7a81a9280e1893a6066ae
-
SHA256
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb
-
SHA512
619fbdec0c6639ad0a15ac27a5de41fc302d671740f3b0f19be362a2110355c51f93898ed408b337f73623b1210ed0dd4585acfd6603b9ce767faeb84d1b40f6
-
SSDEEP
3072:LjM4omazat8Sm0JjICd0BKTGAu+vEegNgbRvFcka8rKVO3gFtvlpb/:LjM4oFMYCyoqAuOEuV9cz8rKO4V
Malware Config
Extracted
dridex
185.206.146.88:443
5.44.45.177:443
185.16.41.224:443
Signatures
-
Deletes itself 1 IoCs
Processes:
msra.exepid process 1756 msra.exe -
Processes:
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exemsra.exepid process 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe 1756 msra.exe 1756 msra.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exedescription pid process Token: SeRestorePrivilege 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exedescription pid process target process PID 1048 wrote to memory of 1756 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe msra.exe PID 1048 wrote to memory of 1756 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe msra.exe PID 1048 wrote to memory of 1756 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe msra.exe PID 1048 wrote to memory of 1756 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe msra.exe PID 1048 wrote to memory of 1756 1048 cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe msra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe"C:\Users\Admin\AppData\Local\Temp\cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\msra.exeC:\Windows\SysWOW64\msra.exe "C:\Users\Admin\AppData\Local\Temp\cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:1756
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-54-0x0000000000380000-0x00000000003AC000-memory.dmpFilesize
176KB
-
memory/1048-56-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-59-0x0000000000160000-0x000000000017A000-memory.dmpFilesize
104KB
-
memory/1756-57-0x0000000000000000-mapping.dmp
-
memory/1756-60-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-61-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-63-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-62-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-64-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-65-0x0000000000130000-0x000000000015C000-memory.dmpFilesize
176KB
-
memory/1756-71-0x0000000000230000-0x000000000024A000-memory.dmpFilesize
104KB