Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-03-2023 06:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98.exe

  • Size

    328KB

  • MD5

    ce7ad82066eaab614b8a0f206225cc88

  • SHA1

    ea9058be68f3226d34e4a08fe3489fde5e64433b

  • SHA256

    db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98

  • SHA512

    6c3a52ecf9cf21a4b2c7caedd1ce49a68293964bb8221f3a3acc644b6494422a8b71055b154db08cfe9783eb935de5deacde6060fe4a612d2bc88f2c6a8d5136

  • SSDEEP

    6144:evSBanJK/5kPas8N0HEAAf1vbViarAWbd33mEPT:evjas8uHEAAtvBpkzEPT

Score
10/10
pseudomanuscryptloader

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 28 IoCs
    loader
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1008
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1040
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1256
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1392
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1496
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1872
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2364
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2352
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1140
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2644
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2652
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k WspService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4612
  • C:\Users\Admin\AppData\Local\Temp\db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98.exe
    "C:\Users\Admin\AppData\Local\Temp\db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Users\Admin\AppData\Local\Temp\db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98.exe
      "C:\Users\Admin\AppData\Local\Temp\db322672530c557169da3977d42b6a3c341c60034ca58b9c4a96db39d39f1d98.exe" -h
      2⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4952
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\db.dat
    Filesize

    557KB

    MD5

    faffe00e3975b787f9396ae6202602cc

    SHA1

    36859bf2965ca631f133334b3990b5ce2cea5cfc

    SHA256

    f223cdd6abc9015a1920b175bbe0c0e6eb5cadbe362a6d95d6fa60eeb6c83c99

    SHA512

    4b3f9e05d995cc575777add3692140e097975ed365ee9daa9d235e2fb665e5d1c7b625c896e993cda3a65d960183e13e66c98b2141e1e2eb58318353949b7f52

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\db.dll
    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    Download Submit
  • memory/1008-135-0x0000022484000000-0x0000022484072000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1008-146-0x0000022484000000-0x0000022484072000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1040-204-0x0000018F828D0000-0x0000018F82942000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1040-169-0x0000018F828D0000-0x0000018F82942000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1140-163-0x000001717BF30000-0x000001717BFA2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1140-203-0x000001717BF30000-0x000001717BFA2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1256-211-0x000001F30A820000-0x000001F30A892000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1256-189-0x000001F30A820000-0x000001F30A892000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1392-213-0x0000019937E40000-0x0000019937EB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1392-195-0x0000019937E40000-0x0000019937EB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1496-207-0x000002B682C40000-0x000002B682CB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1496-176-0x000002B682C40000-0x000002B682CB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1872-209-0x0000023C2AF20000-0x0000023C2AF92000-memory.dmp
    Filesize

    456KB

    Download
  • memory/1872-183-0x0000023C2AF20000-0x0000023C2AF92000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2352-151-0x0000016A04D70000-0x0000016A04DE2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2352-199-0x0000016A04D70000-0x0000016A04DE2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2364-200-0x000001EF91140000-0x000001EF911B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2364-157-0x000001EF91140000-0x000001EF911B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2644-229-0x000001ECFB040000-0x000001ECFB0B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2644-212-0x000001ECFB040000-0x000001ECFB0B2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2652-230-0x00000187ABA40000-0x00000187ABAB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2652-221-0x00000187ABA40000-0x00000187ABAB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2664-129-0x0000019B45A40000-0x0000019B45AB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2664-144-0x0000019B45A40000-0x0000019B45AB2000-memory.dmp
    Filesize

    456KB

    Download
  • memory/2664-126-0x0000019B45030000-0x0000019B4507D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/2664-131-0x0000019B45030000-0x0000019B4507D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/4352-224-0x0000000004F70000-0x0000000004FCE000-memory.dmp
    Filesize

    376KB

    Download
  • memory/4352-140-0x0000000004E60000-0x0000000004F6C000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4352-142-0x0000000004F70000-0x0000000004FCE000-memory.dmp
    Filesize

    376KB

    Download
  • memory/4612-197-0x000001ABCBB00000-0x000001ABCBB72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/4612-141-0x000001ABCBB00000-0x000001ABCBB72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/4612-150-0x000001ABCBB00000-0x000001ABCBB72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/4612-232-0x000001ABCBB00000-0x000001ABCBB72000-memory.dmp
    Filesize

    456KB

    Download
  • memory/4612-245-0x000001ABCB9B0000-0x000001ABCB9CB000-memory.dmp
    Filesize

    108KB

    Download
  • memory/4612-248-0x000001ABCE200000-0x000001ABCE30B000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4612-250-0x000001ABCB9D0000-0x000001ABCB9F0000-memory.dmp
    Filesize

    128KB

    Download
  • memory/4612-251-0x000001ABCD340000-0x000001ABCD35B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/4612-261-0x000001ABCE200000-0x000001ABCE30B000-memory.dmp
    Filesize

    1.0MB

    Download