Analysis

  • max time kernel
    21s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 15:41

General

  • Target

    ddbbe63a86fa196d739928c165f32cac.dll

  • Size

    1.7MB

  • MD5

    ddbbe63a86fa196d739928c165f32cac

  • SHA1

    6762a54f563ac149a70487d45c9f2b0146a0f38b

  • SHA256

    2a9d2e3b8a8a847b49653f88fa4da14ef6798706f216af7a739f157dec5746ea

  • SHA512

    2b5a7c5ebd2bf153101df35a4656600d419e7e889cf61ac44b503c13be6b84c986b70ea00cf1d4ac72504f9d128477e0dae2697330f1635dceb807a876993430

  • SSDEEP

    12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2512
  • C:\Windows\system32\dwm.exe
    C:\Windows\system32\dwm.exe
    1⤵
      PID:3496
    • C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe
      C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3048
    • C:\Windows\system32\AtBroker.exe
      C:\Windows\system32\AtBroker.exe
      1⤵
        PID:2324
      • C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe
        C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4792
      • C:\Windows\system32\mspaint.exe
        C:\Windows\system32\mspaint.exe
        1⤵
          PID:5080
        • C:\Users\Admin\AppData\Local\chXxaK\mspaint.exe
          C:\Users\Admin\AppData\Local\chXxaK\mspaint.exe
          1⤵
            PID:4312
          • C:\Windows\system32\BackgroundTransferHost.exe
            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4312

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

            Filesize

            92KB

            MD5

            5c27608411832c5b39ba04e33d53536c

            SHA1

            f92f8b7439ce1de4c297046ed1d3ff9f20bc97af

            SHA256

            0ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565

            SHA512

            1fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309

          • C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

            Filesize

            36KB

            MD5

            f9997c2400aee2450643c2c9adaeea15

            SHA1

            a1db14e70040d60db9b0dfb08f5d3ae726053687

            SHA256

            5d4e234ab8cf39db3e5f755c2c96d4ed64d0ad625e1d789847bd7a8b3ff39979

            SHA512

            663372cf078133ef77c8e6c3987abc5288fcb222d7d8353a09bce9b95f40fa95eb99f36653ab294233d940118331306cf980bedc5d523ca43ed26292ac9eaecf

          • C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

            Filesize

            14KB

            MD5

            f1c9edff9708b785430513ee896e8a73

            SHA1

            490779b6e1c81a90b6308be3e02dff1846039709

            SHA256

            bd71f681a70c36e4e64279c8ea7c6ea92c9188b24b1997d9f4e04cd5be01f3c4

            SHA512

            5b7179aaaa0f105ae2d0fa70de761e6fd7281ec80ce6936ca5a0a90017fbd3a2e6998055c0f855e36498a82d28ed1b86dea0889ebbffa605d61d76315606f30b

          • C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

            Filesize

            52KB

            MD5

            321e0c8a3c4975ac5aed3d7b982a2b91

            SHA1

            870ccbb8e56d7f92368381fd0b1352ddaaa01478

            SHA256

            0ea7fa75aa4b6b9d308c7068f44747fb8b5ee9a74b7a0ec989da44637ad0234d

            SHA512

            2ec7ae6aa11b6bccf7ccba7660458f27658341ac3d8f3c95af6dd8e38620ab2856bbdceed8f6dce599375dd5fa40153cccc747ebc5db03564e07f596fe70c6d6

          • C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Udjzqp.lnk

            Filesize

            1KB

            MD5

            9c087fcb22c8baae2de82e60874edadd

            SHA1

            93c2226d83c2bfa9d8ec0bacf3cd06d794e02045

            SHA256

            6b955db2186fcc90807d854feceb30b2952d62219d5ea5ea4ab10833befe7723

            SHA512

            cbe602359ea32c1ca443472648e43afadfdf18ebbcb72472ac98ee8795101e2c112987e2cd8c510b880ce8b8dd1c469cf20e6e5d24a5e913fe5bc55712ebb5a7

          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7AUkTp84EI\UxTheme.dll

            Filesize

            40KB

            MD5

            ced5f9c1b46d069d66fa391f6c4fbc37

            SHA1

            ba71df78fa84bbc841e50da15b6f94a4a434ee52

            SHA256

            e29fd8548c7e6cdadc94a34377304c62105b7d1cc2d502da954c1bcd62a9b82f

            SHA512

            62b833cfbfed520a9da079379975a8c05b5db2816100b1ac9241004a72d2af0717943cdc6dee58513f490bd00b25c2c078cbb9410df6b701596edbb7f1293f0e

          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\r0zTomov3L\MFC42u.dll

            Filesize

            126KB

            MD5

            ccbff4b93a8275a6d07673af73f3de33

            SHA1

            7a4630ffdf4434da315c390e63671a5d049be151

            SHA256

            cc7aaf1019ab41d6440741fb297baf8877b87cfebcd5a7794b68a6cf3b74aaaf

            SHA512

            6578b9209ccc8001e3f8e1a3506eba235519939563e1613e36f20c2357a19476b37d7b8f5f4d30ea45a303bc4cbb0d61a718c7d20a576c984d0b4d4ee08b6b04

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\CFsRwiA3\dwm.exe

            Filesize

            59KB

            MD5

            9f793a96f2c6b59553e4fe588d5e6c5a

            SHA1

            8720fde8e8ae9f26843b485ed29d00b92639b3fc

            SHA256

            314652e400511acfd728b50b8bbbe1f55fb9034d31f30e90dc8b48d96b36a48f

            SHA512

            608666d5adf250a7a5ac8a9f8b17e76a6be235e214ab8a3555c435493bdc39ce776615f1c366afd37bb8ac5fecfabaa2d9429b92dbe954b28dd15c2868396b8b

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\CFsRwiA3\dxgi.dll

            Filesize

            164KB

            MD5

            8f39f59d551d3dea8a997fe20b2806e6

            SHA1

            4740024c1afd9e2537f28da89e926ca2fdbd9ea0

            SHA256

            bbb9967c0fad6df92ff2905f27b9b1759380f4ec95ed7a659e2a031b29f5509e

            SHA512

            18a479ca78241a90ea65771471961a2cb073403ec675a0222b05502c7411b4ebeb55561199fbf8357a8c971d29cbec9290093c82750791e788b388b37b3da035

          • memory/2512-8-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/2512-0-0x000001B499EF0000-0x000001B499EF7000-memory.dmp

            Filesize

            28KB

          • memory/2512-1-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3048-74-0x00000219B1F00000-0x00000219B1F07000-memory.dmp

            Filesize

            28KB

          • memory/3048-78-0x0000000140000000-0x00000001401B6000-memory.dmp

            Filesize

            1.7MB

          • memory/3048-75-0x0000000140000000-0x00000001401B6000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-24-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-22-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-32-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-30-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-29-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-36-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-40-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-42-0x0000000001560000-0x0000000001567000-memory.dmp

            Filesize

            28KB

          • memory/3436-41-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-39-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-38-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-37-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-35-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-34-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-33-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-27-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-49-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-59-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-61-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-53-0x00007FFCBFB60000-0x00007FFCBFB70000-memory.dmp

            Filesize

            64KB

          • memory/3436-25-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-26-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-23-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-31-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-19-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-28-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-21-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-20-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-17-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-14-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-13-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-12-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-11-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-18-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-16-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-5-0x00007FFCBE60A000-0x00007FFCBE60B000-memory.dmp

            Filesize

            4KB

          • memory/3436-4-0x0000000003380000-0x0000000003381000-memory.dmp

            Filesize

            4KB

          • memory/3436-15-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-7-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-9-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/3436-10-0x0000000140000000-0x00000001401B5000-memory.dmp

            Filesize

            1.7MB

          • memory/4312-106-0x0000000140000000-0x00000001401BC000-memory.dmp

            Filesize

            1.7MB

          • memory/4312-109-0x0000000140000000-0x00000001401BC000-memory.dmp

            Filesize

            1.7MB

          • memory/4312-105-0x0000016FD6180000-0x0000016FD6187000-memory.dmp

            Filesize

            28KB

          • memory/4792-93-0x0000000140000000-0x00000001401B6000-memory.dmp

            Filesize

            1.7MB

          • memory/4792-88-0x000002A38BDC0000-0x000002A38BDC7000-memory.dmp

            Filesize

            28KB