Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22-02-2023 08:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476.exe

  • Size

    312KB

  • MD5

    920fad6850908e6cfde57c6a07ae8479

  • SHA1

    8e0bd4e1dda0696ab0835193cfbe9b9f0c934ecb

  • SHA256

    174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476

  • SHA512

    666f9b9e944745628fef0511d44336818609c3f7fb7f6b5d4c485197c818d916d557f0903ccff3598a86c8c3a9730d3e1e16fcb176f1ee628d28f05a002a5cda

  • SSDEEP

    6144:E4PWLN3m+XeeqeO0UQeQ8KbLVHqAQg5jIQsYEPn:6aeqeO0UQB8KFHqAYYEPn

Score
10/10
pseudomanuscryptloader

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 28 IoCs
    loader
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:352
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1112
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1312
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1444
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1836
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2232
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k WspService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4120
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2396
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2240
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1260
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1072
  • C:\Users\Admin\AppData\Local\Temp\174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476.exe
    "C:\Users\Admin\AppData\Local\Temp\174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476.exe
      "C:\Users\Admin\AppData\Local\Temp\174718baa52be823cb48cd1ec12a53f631eaad512eee0fdce1e79f243dca4476.exe" -h
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2280
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\db.dat
    Filesize

    557KB

    MD5

    d8fdf3094adfa6cd96ad85cb3b1c0888

    SHA1

    e1ff8d0d9d04b6da1c78fa2eeb002f89e1c217ef

    SHA256

    234b037565a89b5d3cdabb963390b84bbfb23f68de1d7a940d250c13d6eb2087

    SHA512

    a55f0f2a2bc7182c639de20bcafab8ad71416665b3e9f24276d55a03312f0a0014ff12916a08f42edbfd8f58b2bc59e01010271bed028c2c67cce97535af6a94

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit

  • memory/352-140-0x000001C4D9800000-0x000001C4D9872000-memory.dmp

    Filesize

    456KB

    Download

  • memory/352-158-0x000001C4D9800000-0x000001C4D9872000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1072-173-0x000001FACC4D0000-0x000001FACC542000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1072-208-0x000001FACC4D0000-0x000001FACC542000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1112-206-0x00000208B0240000-0x00000208B02B2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1112-166-0x00000208B0240000-0x00000208B02B2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1260-198-0x000002220B900000-0x000002220B972000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1260-215-0x000002220B900000-0x000002220B972000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1312-192-0x00000267EC510000-0x00000267EC582000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1312-213-0x00000267EC510000-0x00000267EC582000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1444-210-0x000001E2AD200000-0x000001E2AD272000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1444-180-0x000001E2AD200000-0x000001E2AD272000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1836-211-0x000002DD85450000-0x000002DD854C2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1836-186-0x000002DD85450000-0x000002DD854C2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2232-149-0x0000020340030000-0x00000203400A2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2232-161-0x0000020340030000-0x00000203400A2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2240-157-0x000001E46BB40000-0x000001E46BBB2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2240-202-0x000001E46BB40000-0x000001E46BBB2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2388-205-0x0000028D4A640000-0x0000028D4A6B2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2388-217-0x0000028D4A640000-0x0000028D4A6B2000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2396-218-0x0000024F49010000-0x0000024F49082000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2396-229-0x0000024F49010000-0x0000024F49082000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2572-133-0x000002463F310000-0x000002463F35D000-memory.dmp

    Filesize

    308KB

    Download

  • memory/2572-131-0x000002463FB00000-0x000002463FB72000-memory.dmp

    Filesize

    456KB

    Download

  • memory/2572-128-0x000002463F310000-0x000002463F35D000-memory.dmp

    Filesize

    308KB

    Download

  • memory/2572-154-0x000002463FB00000-0x000002463FB72000-memory.dmp

    Filesize

    456KB

    Download

  • memory/3980-225-0x0000000004B40000-0x0000000004B9E000-memory.dmp

    Filesize

    376KB

    Download

  • memory/3980-127-0x0000000004B40000-0x0000000004B9E000-memory.dmp

    Filesize

    376KB

    Download

  • memory/3980-126-0x00000000049D0000-0x0000000004AD7000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4120-147-0x000002542D7D0000-0x000002542D842000-memory.dmp

    Filesize

    456KB

    Download

  • memory/4120-156-0x000002542D7D0000-0x000002542D842000-memory.dmp

    Filesize

    456KB

    Download

  • memory/4120-139-0x000002542D7D0000-0x000002542D842000-memory.dmp

    Filesize

    456KB

    Download

  • memory/4120-231-0x000002542D7D0000-0x000002542D842000-memory.dmp

    Filesize

    456KB

    Download

  • memory/4120-242-0x000002542F010000-0x000002542F02B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4120-243-0x000002542FD00000-0x000002542FE0A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4120-244-0x000002542F050000-0x000002542F070000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4120-245-0x000002542F090000-0x000002542F0AB000-memory.dmp

    Filesize

    108KB

    Download