aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095
aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095.dll
1MB
26-11-2021 09:32
29534b5fb245c4b5ff146d14d9da9c54
fbaa21729651810b5db05e4c421b4bd269ea3825
aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095
Filter: none
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Dridex Shellcode
Description
Detects Dridex Payload shellcode injected in Explorer process.
Tags
Reported IOCs
resource yara_rule behavioral1/memory/1400-60-0x00000000029D0000-0x00000000029D1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXEBitLockerWizard.exesigverif.exemsra.exe
Reported IOCs
pid process 1056 BitLockerWizard.exe 1232 sigverif.exe 1792 msra.exe -
Loads dropped DLLBitLockerWizard.exesigverif.exemsra.exe
Reported IOCs
pid process 1400 1056 BitLockerWizard.exe 1400 1232 sigverif.exe 1400 1792 msra.exe 1400 -
Adds Run key to start application
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Myzdcwow = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\#SHARE~1\\MFWXZM~1\\sigverif.exe" -
Checks whether UAC is enabledrundll32.exeBitLockerWizard.exesigverif.exemsra.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BitLockerWizard.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sigverif.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msra.exe -
Suspicious behavior: EnumeratesProcessesrundll32.exeBitLockerWizard.exesigverif.exe
Reported IOCs
pid process 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1056 BitLockerWizard.exe 1056 BitLockerWizard.exe 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1232 sigverif.exe 1232 sigverif.exe 1400 1400 1400 1400 -
Suspicious behavior: GetForegroundWindowSpam
Reported IOCs
pid process 1400 -
Suspicious use of WriteProcessMemory
Reported IOCs
description pid process target process PID 1400 wrote to memory of 1192 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1192 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1192 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1056 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1056 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1056 1400 BitLockerWizard.exe PID 1400 wrote to memory of 1652 1400 sigverif.exe PID 1400 wrote to memory of 1652 1400 sigverif.exe PID 1400 wrote to memory of 1652 1400 sigverif.exe PID 1400 wrote to memory of 1232 1400 sigverif.exe PID 1400 wrote to memory of 1232 1400 sigverif.exe PID 1400 wrote to memory of 1232 1400 sigverif.exe PID 1400 wrote to memory of 996 1400 msra.exe PID 1400 wrote to memory of 996 1400 msra.exe PID 1400 wrote to memory of 996 1400 msra.exe PID 1400 wrote to memory of 1792 1400 msra.exe PID 1400 wrote to memory of 1792 1400 msra.exe PID 1400 wrote to memory of 1792 1400 msra.exe
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095.dll,#1Checks whether UAC is enabledSuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe
-
C:\Users\Admin\AppData\Local\v8KH\BitLockerWizard.exeC:\Users\Admin\AppData\Local\v8KH\BitLockerWizard.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabledSuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe
-
C:\Users\Admin\AppData\Local\4CNOY\sigverif.exeC:\Users\Admin\AppData\Local\4CNOY\sigverif.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabledSuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe
-
C:\Users\Admin\AppData\Local\CamZ2q\msra.exeC:\Users\Admin\AppData\Local\CamZ2q\msra.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\4CNOY\VERSION.dll
MD55a2f5e3a29b9293b8e1e8e2579700c7c
SHA14fe35a53da55cdc65a0a638e81144d374d1620ec
SHA25699db4d45c48313415daaa723b4f8a834b0222434169d8a7d974adb134b516170
SHA512f56a3bd860f713df487bf3f1fd9440129fc2cfd8644592c319b323fef47bb1325a5e4baeef790b04a4b93567a1474cff6f2a25e8b367fe75523d3a34ed6b0036
-
C:\Users\Admin\AppData\Local\4CNOY\sigverif.exe
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
C:\Users\Admin\AppData\Local\CamZ2q\NDFAPI.DLL
MD5e11d74926cefed9e27d115b5eb723e08
SHA10cc12f4f94e7e627ed4ecf1df849e3eeb1395d11
SHA256dde36be42dc196582998e211975e36ab9f8a1a4840821e266887a3fe9e0d6bbf
SHA5128422bcdaaf7699cdb8bdf20a6fe77dd30fc7ef580850f9c4cc693cb96ff5370d604141cbe076667e2b4306e301ae0143887d45fc02ea1e909e18fb0a0dc6433e
-
C:\Users\Admin\AppData\Local\CamZ2q\msra.exe
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
C:\Users\Admin\AppData\Local\v8KH\BitLockerWizard.exe
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
C:\Users\Admin\AppData\Local\v8KH\FVEWIZ.dll
MD5c525cea0097e06727f4f95fe070ec242
SHA18bc2dab6eaef3476bc43378f20125d912fbb87af
SHA256b68e5ce6b0363bc6cbe7167af733d89c125544bc6a2330c04e012ee65a0ecaf8
SHA512e5cb93d2240186820ad4ea89c659b841b52cee47100914d3370127c20b315b1b390992ff8b3535a265a21dc986184673fc209af65775abf3f2726a3c96292f99
-
\Users\Admin\AppData\Local\4CNOY\VERSION.dll
MD55a2f5e3a29b9293b8e1e8e2579700c7c
SHA14fe35a53da55cdc65a0a638e81144d374d1620ec
SHA25699db4d45c48313415daaa723b4f8a834b0222434169d8a7d974adb134b516170
SHA512f56a3bd860f713df487bf3f1fd9440129fc2cfd8644592c319b323fef47bb1325a5e4baeef790b04a4b93567a1474cff6f2a25e8b367fe75523d3a34ed6b0036
-
\Users\Admin\AppData\Local\4CNOY\sigverif.exe
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
\Users\Admin\AppData\Local\CamZ2q\NDFAPI.DLL
MD5e11d74926cefed9e27d115b5eb723e08
SHA10cc12f4f94e7e627ed4ecf1df849e3eeb1395d11
SHA256dde36be42dc196582998e211975e36ab9f8a1a4840821e266887a3fe9e0d6bbf
SHA5128422bcdaaf7699cdb8bdf20a6fe77dd30fc7ef580850f9c4cc693cb96ff5370d604141cbe076667e2b4306e301ae0143887d45fc02ea1e909e18fb0a0dc6433e
-
\Users\Admin\AppData\Local\CamZ2q\msra.exe
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
\Users\Admin\AppData\Local\v8KH\BitLockerWizard.exe
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
\Users\Admin\AppData\Local\v8KH\FVEWIZ.dll
MD5c525cea0097e06727f4f95fe070ec242
SHA18bc2dab6eaef3476bc43378f20125d912fbb87af
SHA256b68e5ce6b0363bc6cbe7167af733d89c125544bc6a2330c04e012ee65a0ecaf8
SHA512e5cb93d2240186820ad4ea89c659b841b52cee47100914d3370127c20b315b1b390992ff8b3535a265a21dc986184673fc209af65775abf3f2726a3c96292f99
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G3\msra.exe
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
memory/860-58-0x0000000000180000-0x0000000000187000-memory.dmp
-
memory/860-55-0x000007FEF6730000-0x000007FEF6878000-memory.dmp
-
memory/1056-84-0x0000000000000000-mapping.dmp
-
memory/1056-88-0x000007FEF69B0000-0x000007FEF6AF9000-memory.dmp
-
memory/1232-98-0x000007FEF6730000-0x000007FEF6879000-memory.dmp
-
memory/1232-95-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp
-
memory/1232-93-0x0000000000000000-mapping.dmp
-
memory/1400-66-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-77-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-69-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-71-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-73-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-75-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-61-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-76-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-62-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-74-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-63-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-72-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-68-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-65-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-70-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-60-0x00000000029D0000-0x00000000029D1000-memory.dmp
-
memory/1400-67-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-64-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/1400-82-0x0000000077590000-0x0000000077592000-memory.dmp
-
memory/1792-103-0x0000000000000000-mapping.dmp