Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2022 04:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca.exe

  • Size

    4.1MB

  • MD5

    e16394ef0b1dedaad80491307fa24d5d

  • SHA1

    72d20ec1bd531b097b468bda5776ad01775d5233

  • SHA256

    b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca

  • SHA512

    9cef7437487cfe9ae8c9d728a98a4502ecd883999bd9bdae4a1ed3eeda3aae235baa2455df2b1d0827aac939584bc26f8c7a11d32ed3d9d10da2104e4ca2490f

  • SSDEEP

    98304:NhRnhNDa9+zSAsOLrac/AMj5qF52Ut8+cduuuRtnHpM8IK:ZhG+VsOHTAMj5wUh+NLRtnJM8V

Score
10/10
evasion

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca.exe
    "C:\Users\Admin\AppData\Local\Temp\b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca.exe
      "C:\Users\Admin\AppData\Local\Temp\b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca.exe"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1264
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
          PID:748
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:4316
        • C:\Windows\rss\csrss.exe
          C:\Windows\rss\csrss.exe
          3⤵
            PID:4368
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2116

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\rss\csrss.exe
        Filesize

        4.1MB

        MD5

        e16394ef0b1dedaad80491307fa24d5d

        SHA1

        72d20ec1bd531b097b468bda5776ad01775d5233

        SHA256

        b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca

        SHA512

        9cef7437487cfe9ae8c9d728a98a4502ecd883999bd9bdae4a1ed3eeda3aae235baa2455df2b1d0827aac939584bc26f8c7a11d32ed3d9d10da2104e4ca2490f

        Download Submit

      • C:\Windows\rss\csrss.exe
        Filesize

        4.1MB

        MD5

        e16394ef0b1dedaad80491307fa24d5d

        SHA1

        72d20ec1bd531b097b468bda5776ad01775d5233

        SHA256

        b94cf0bd4680a028647b8588a054f5f9faa7e67a8ddaa936c5c51dda616c73ca

        SHA512

        9cef7437487cfe9ae8c9d728a98a4502ecd883999bd9bdae4a1ed3eeda3aae235baa2455df2b1d0827aac939584bc26f8c7a11d32ed3d9d10da2104e4ca2490f

        Download Submit

      • memory/1264-138-0x000000000291B000-0x0000000002D04000-memory.dmp

        Filesize

        3.9MB

        Download

      • memory/1264-139-0x0000000000400000-0x0000000000C91000-memory.dmp

        Filesize

        8.6MB

        Download

      • memory/1264-144-0x0000000000400000-0x0000000000C91000-memory.dmp

        Filesize

        8.6MB

        Download

      • memory/3408-136-0x0000000000400000-0x0000000000C91000-memory.dmp

        Filesize

        8.6MB

        Download

      • memory/3408-132-0x00000000028FD000-0x0000000002CE6000-memory.dmp

        Filesize

        3.9MB

        Download

      • memory/3408-134-0x0000000000400000-0x0000000000C91000-memory.dmp

        Filesize

        8.6MB

        Download

      • memory/3408-133-0x0000000002CF0000-0x0000000003566000-memory.dmp

        Filesize

        8.5MB

        Download