Analysis
-
max time kernel
30s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 20:09
Static task
static1
Behavioral task
behavioral1
Sample
02a0cd716c96815422f1fc564501caa7.dll
Resource
win7-20231215-en
General
-
Target
02a0cd716c96815422f1fc564501caa7.dll
-
Size
2.0MB
-
MD5
02a0cd716c96815422f1fc564501caa7
-
SHA1
db2c33750e463f702b50f2d8c4d765c7f9c7866f
-
SHA256
03c531f4b15ced54d56d9202a64d3ba2d2f5996c6cc290cc6a5ccf9a777afed4
-
SHA512
a201da4d62323fc02b330591a9f203f00713670f7963338667b4fb9b015252f6d6a76d40c6697f982a18bedac88bf5824d4d01e2a311195665a6ebafbe4ed63a
-
SSDEEP
12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3556-4-0x0000000007CA0000-0x0000000007CA1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
SystemPropertiesHardware.exeDevicePairingWizard.exeAgentService.exepid Process 1820 SystemPropertiesHardware.exe 3900 DevicePairingWizard.exe 2728 AgentService.exe -
Loads dropped DLL 3 IoCs
Processes:
SystemPropertiesHardware.exeDevicePairingWizard.exeAgentService.exepid Process 1820 SystemPropertiesHardware.exe 3900 DevicePairingWizard.exe 2728 AgentService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qzenv = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\Recent\\IHUzwbt\\DevicePairingWizard.exe" -
Processes:
rundll32.exeSystemPropertiesHardware.exeDevicePairingWizard.exeAgentService.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SystemPropertiesHardware.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DevicePairingWizard.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AgentService.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid Process 3628 rundll32.exe 3628 rundll32.exe 3628 rundll32.exe 3628 rundll32.exe 3628 rundll32.exe 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 3556 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid Process Token: SeShutdownPrivilege 3556 Token: SeCreatePagefilePrivilege 3556 Token: SeShutdownPrivilege 3556 Token: SeCreatePagefilePrivilege 3556 Token: SeShutdownPrivilege 3556 Token: SeCreatePagefilePrivilege 3556 Token: SeShutdownPrivilege 3556 Token: SeCreatePagefilePrivilege 3556 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid Process 3556 3556 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid Process procid_target PID 3556 wrote to memory of 2648 3556 81 PID 3556 wrote to memory of 2648 3556 81 PID 3556 wrote to memory of 1820 3556 82 PID 3556 wrote to memory of 1820 3556 82 PID 3556 wrote to memory of 4848 3556 83 PID 3556 wrote to memory of 4848 3556 83 PID 3556 wrote to memory of 3900 3556 90 PID 3556 wrote to memory of 3900 3556 90 PID 3556 wrote to memory of 1328 3556 87 PID 3556 wrote to memory of 1328 3556 87 PID 3556 wrote to memory of 2728 3556 86 PID 3556 wrote to memory of 2728 3556 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02a0cd716c96815422f1fc564501caa7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3628
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵PID:2648
-
C:\Users\Admin\AppData\Local\dAk\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\dAk\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1820
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵PID:4848
-
C:\Users\Admin\AppData\Local\DjLP32fGd\AgentService.exeC:\Users\Admin\AppData\Local\DjLP32fGd\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2728
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵PID:1328
-
C:\Users\Admin\AppData\Local\uaWI4\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\uaWI4\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3900