Analysis

  • max time kernel
    153s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    26-11-2021 09:32

General

  • Target

    34b87ca49b68d8e9f165cba7fbdd47c091619ea7f81eef67464419367a63e7a6.dll

  • Size

    1.2MB

  • MD5

    4a053f11069bec3a06df7a99d9869728

  • SHA1

    57eae9d729bd6b6d1f838a3cbbcbd89e8d1bc325

  • SHA256

    34b87ca49b68d8e9f165cba7fbdd47c091619ea7f81eef67464419367a63e7a6

  • SHA512

    48142ffd279f8117376ce021bcd68345c2af6cf689125f4aefc6e8c2391cb412037725026e535dd7b43318c203f35c6c0c058ecc7888bb3319c98f90cb9f486c

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\34b87ca49b68d8e9f165cba7fbdd47c091619ea7f81eef67464419367a63e7a6.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3760
  • C:\Windows\system32\LockScreenContentServer.exe
    C:\Windows\system32\LockScreenContentServer.exe
    1⤵
      PID:1252
    • C:\Users\Admin\AppData\Local\qzSK\LockScreenContentServer.exe
      C:\Users\Admin\AppData\Local\qzSK\LockScreenContentServer.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      PID:1004
    • C:\Windows\system32\CameraSettingsUIHost.exe
      C:\Windows\system32\CameraSettingsUIHost.exe
      1⤵
        PID:784
      • C:\Users\Admin\AppData\Local\SBuGQT46p\CameraSettingsUIHost.exe
        C:\Users\Admin\AppData\Local\SBuGQT46p\CameraSettingsUIHost.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2684
      • C:\Windows\system32\sessionmsg.exe
        C:\Windows\system32\sessionmsg.exe
        1⤵
          PID:1268
        • C:\Users\Admin\AppData\Local\9exBDrG9\sessionmsg.exe
          C:\Users\Admin\AppData\Local\9exBDrG9\sessionmsg.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1132

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        1
        T1112

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\9exBDrG9\DUI70.dll
          MD5

          c5ad02e75292bf87e987ac7058c5fbf5

          SHA1

          cfb3e2f088755289f9714d5aba01c69705a448c8

          SHA256

          a5095256983e9388755bb563ccd117c246d7ab40e6bc8e42eeba73a8c97577ae

          SHA512

          93336183f19965e244c9449db3fe484244f709f67f988d4d25261df7112f1eeedd5b77df5968c99bd7bdf66f57af3088313fc974ca295ef5abb41b890710b2f6

        • C:\Users\Admin\AppData\Local\9exBDrG9\sessionmsg.exe
          MD5

          c9a3d374ad75f5d9ee720412c96b6f94

          SHA1

          5cec5ea0e5f5a6ed7e4726fe39e50563a351c9c8

          SHA256

          4b54ea036af8b81b91bd4fbb04b4405d4c788f178a177201e66a7bc6fb778a0d

          SHA512

          a63730ef7ade9dcfa5afecefe92eb897f9bb4284049b49445f95f44228173ccd5890e65e2b6257f8c4431b468b9b1d664c5cc1b836240413a20fb7b46e49b0ec

        • C:\Users\Admin\AppData\Local\SBuGQT46p\CameraSettingsUIHost.exe
          MD5

          a2f3bedc6124ad9d582ebd5086be2aa2

          SHA1

          5586e7796ea73cfb4aac094905b334b12de8a151

          SHA256

          dd3ceee2dcd4884fbd46676045ab4a02ce4c0a0a4ad13ab54364c6e136c259a0

          SHA512

          9dc1909e07326c55c2eff881b31d0146a595010a8ae78ae9afd64093b2b691c75f68de873acee27d2093a34c0431ee81e693d24d8241c2f4805590a11be9d07b

        • C:\Users\Admin\AppData\Local\SBuGQT46p\DUI70.dll
          MD5

          303890d0d058472a36e41c0ecb9a48b5

          SHA1

          ab3af59fc10c2e86f3559ec81259826970f63047

          SHA256

          e0118fe6f1d0a8b38d7fe691795e4afd06878f0b18851bbd78fa8ea6ac4c49dd

          SHA512

          6524893b1cb27117f273f04f07a4e3cb5379d11652ef57791a3f408b4807422e11490800384f309409da08de878a3f85c802285292aae48fa25900a9c111b09b

        • C:\Users\Admin\AppData\Local\qzSK\DUser.dll
          MD5

          a4c06c207f30c71063afd1069d214e3e

          SHA1

          f7a4ab64014e7135d1bc510f7f40209a7b3859ac

          SHA256

          1ee594383192b842f6e872f78edd150c1f3fda21d103ff6e4923e07ad6845fc7

          SHA512

          7f8eb5fb0ee40af2610631021321400105063cbfee6c12cfe8d6e01251ef1aafefe07306d2e42a19393987be742587f03dbacf096f6837d082d053bdbc5badb4

        • C:\Users\Admin\AppData\Local\qzSK\LockScreenContentServer.exe
          MD5

          583914a93db0413668eadd743fd5fb1c

          SHA1

          8b95be0ad348f0aabfcceac3148109ef12e8a978

          SHA256

          ec09ee1b2bb981335ea9db3ac031fbbc3ed74f9294d734a5799fb0d75e423583

          SHA512

          2f5c22cc3f557c65c876e8a943c7b3dec92d5c0b5219ab2410a334f42e442ef08d0c7b1c5c0797b83a17578a25ce70aa631a15be7ec6a6ea8a8d865dca0b9cd4

        • \Users\Admin\AppData\Local\9exBDrG9\DUI70.dll
          MD5

          c5ad02e75292bf87e987ac7058c5fbf5

          SHA1

          cfb3e2f088755289f9714d5aba01c69705a448c8

          SHA256

          a5095256983e9388755bb563ccd117c246d7ab40e6bc8e42eeba73a8c97577ae

          SHA512

          93336183f19965e244c9449db3fe484244f709f67f988d4d25261df7112f1eeedd5b77df5968c99bd7bdf66f57af3088313fc974ca295ef5abb41b890710b2f6

        • \Users\Admin\AppData\Local\SBuGQT46p\DUI70.dll
          MD5

          303890d0d058472a36e41c0ecb9a48b5

          SHA1

          ab3af59fc10c2e86f3559ec81259826970f63047

          SHA256

          e0118fe6f1d0a8b38d7fe691795e4afd06878f0b18851bbd78fa8ea6ac4c49dd

          SHA512

          6524893b1cb27117f273f04f07a4e3cb5379d11652ef57791a3f408b4807422e11490800384f309409da08de878a3f85c802285292aae48fa25900a9c111b09b

        • \Users\Admin\AppData\Local\qzSK\DUser.dll
          MD5

          a4c06c207f30c71063afd1069d214e3e

          SHA1

          f7a4ab64014e7135d1bc510f7f40209a7b3859ac

          SHA256

          1ee594383192b842f6e872f78edd150c1f3fda21d103ff6e4923e07ad6845fc7

          SHA512

          7f8eb5fb0ee40af2610631021321400105063cbfee6c12cfe8d6e01251ef1aafefe07306d2e42a19393987be742587f03dbacf096f6837d082d053bdbc5badb4

        • memory/1004-164-0x0000021B8BF10000-0x0000021B8BF12000-memory.dmp
          Filesize

          8KB

        • memory/1004-156-0x0000000000000000-mapping.dmp
        • memory/1004-160-0x00007FFC20720000-0x00007FFC2084D000-memory.dmp
          Filesize

          1.2MB

        • memory/1004-166-0x0000021B8BF10000-0x0000021B8BF12000-memory.dmp
          Filesize

          8KB

        • memory/1004-165-0x0000021B8BF10000-0x0000021B8BF12000-memory.dmp
          Filesize

          8KB

        • memory/1132-178-0x0000000000000000-mapping.dmp
        • memory/1132-186-0x000001DC85FD0000-0x000001DC85FD2000-memory.dmp
          Filesize

          8KB

        • memory/1132-187-0x000001DC85FD0000-0x000001DC85FD2000-memory.dmp
          Filesize

          8KB

        • memory/1132-188-0x000001DC85FD0000-0x000001DC85FD2000-memory.dmp
          Filesize

          8KB

        • memory/2684-175-0x000002221B660000-0x000002221B662000-memory.dmp
          Filesize

          8KB

        • memory/2684-167-0x0000000000000000-mapping.dmp
        • memory/2684-171-0x00007FFC2DBB0000-0x00007FFC2DD21000-memory.dmp
          Filesize

          1.4MB

        • memory/2684-176-0x000002221B660000-0x000002221B662000-memory.dmp
          Filesize

          8KB

        • memory/2684-177-0x000002221B660000-0x000002221B662000-memory.dmp
          Filesize

          8KB

        • memory/2808-132-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-135-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-143-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-144-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-145-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-146-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-151-0x00000000007D0000-0x00000000007D2000-memory.dmp
          Filesize

          8KB

        • memory/2808-152-0x00000000007D0000-0x00000000007D2000-memory.dmp
          Filesize

          8KB

        • memory/2808-153-0x00007FFC3BA05000-0x00007FFC3BA06000-memory.dmp
          Filesize

          4KB

        • memory/2808-154-0x00000000007D0000-0x00000000007D2000-memory.dmp
          Filesize

          8KB

        • memory/2808-155-0x00007FFC3BB40000-0x00007FFC3BB42000-memory.dmp
          Filesize

          8KB

        • memory/2808-141-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-140-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-139-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-138-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-137-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-136-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-142-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-134-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-133-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-122-0x0000000000670000-0x0000000000671000-memory.dmp
          Filesize

          4KB

        • memory/2808-131-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-130-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-127-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-129-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-128-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-126-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-125-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-124-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/2808-123-0x0000000140000000-0x000000014012B000-memory.dmp
          Filesize

          1.2MB

        • memory/3760-115-0x00007FFC2DC00000-0x00007FFC2DD2B000-memory.dmp
          Filesize

          1.2MB

        • memory/3760-121-0x0000022B8B9F0000-0x0000022B8B9F7000-memory.dmp
          Filesize

          28KB

        • memory/3760-120-0x0000022B8BA00000-0x0000022B8BA02000-memory.dmp
          Filesize

          8KB

        • memory/3760-119-0x0000022B8BA00000-0x0000022B8BA02000-memory.dmp
          Filesize

          8KB