Analysis

  • max time kernel
    98s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 15:44

General

  • Target

    deac37150b94c6871f020007e2d20de8.dll

  • Size

    2.0MB

  • MD5

    deac37150b94c6871f020007e2d20de8

  • SHA1

    3b89d6d3afb9fc1111676be750b79ee563e0b51c

  • SHA256

    b9a2afe692a14758fe22e04ec1d379839fcee981e7c82d4c884af960394ccf9a

  • SHA512

    d511b778312473f7987fe3d69b419350a6acf096e3cab9a45b9320e944493bc694da073d502249c2c5f0e4b6452d5c5cdf808f8f12530b4cedd16b8e402ac87f

  • SSDEEP

    12288:gVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:FfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\deac37150b94c6871f020007e2d20de8.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:456
  • C:\Windows\system32\wbengine.exe
    C:\Windows\system32\wbengine.exe
    1⤵
      PID:3348
    • C:\Users\Admin\AppData\Local\BDsfjXfc\wbengine.exe
      C:\Users\Admin\AppData\Local\BDsfjXfc\wbengine.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4492
    • C:\Windows\system32\sdclt.exe
      C:\Windows\system32\sdclt.exe
      1⤵
        PID:3200
      • C:\Users\Admin\AppData\Local\moZL7\sdclt.exe
        C:\Users\Admin\AppData\Local\moZL7\sdclt.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:648
      • C:\Users\Admin\AppData\Local\Ki96x\cmstp.exe
        C:\Users\Admin\AppData\Local\Ki96x\cmstp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1580
      • C:\Windows\system32\cmstp.exe
        C:\Windows\system32\cmstp.exe
        1⤵
          PID:4708

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\1BbZP\VERSION.dll

          Filesize

          31KB

          MD5

          72c68d2e4d307a9d661d573eb3602614

          SHA1

          608ebe396145a6b33676266255dd28f3a2961df8

          SHA256

          63d7daae2811fa2c777ec92b9fcaf6254697bbf3d6259bcf1e7fcdb57ca5a768

          SHA512

          24201d951323ac4f75324cbc1b3e5803a0b845f4823b30021e0ea4ac41216a4544a4a90a19ccd46104c5a979a762026cbd56ac5bdd9ed7318a4cd3501c0d5033

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

          Filesize

          1KB

          MD5

          410e9dda3899daec560597e1a2089af7

          SHA1

          9458a4e231b1cdcf4074d4657e02e883bf0e4868

          SHA256

          8ef93b655645f595b8b8188d2531f7f4750e3d1912812f1ed6b5e691cc11fb62

          SHA512

          34fce71c8dad4324793ab1fec5227e9a935baa3e332c7b2f688412b926b262fc7fab3f2f639853ae7a456cc8acc992be5783f6789e86829e223b30c7f9b87661

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5E3UiaFIPt\ReAgent.dll

          Filesize

          27KB

          MD5

          5f04e842eeb866dfc780944f9aefa0c4

          SHA1

          69b79de26f4179d92e3b276711fa51b95120572f

          SHA256

          d59f31c5d50df792fe322e23c59a2df5035b2da0a6bab2d74245116287bcf398

          SHA512

          a86d2709ff51cc9b074bcd476fa8d97f769e791b4f18d183b8af63272108269de633ef354278949fbcc351539ee491f75bb1133e010be3e17b5de5a4573a128f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\dK\SPP.dll

          Filesize

          85KB

          MD5

          8fae34af42f84b2579dfe7b8597bac5d

          SHA1

          ac10b24681744e83f65356dc3c75ab9f4a67d556

          SHA256

          c05a1e78ea9ac5ebe178c19af69c6f6142a4b461db19a087febea2d5ca8b6483

          SHA512

          366b84a762ea97788d3e32ae5eae3d04a0d9659e40497fb7fc2d5a6bf94bbd7e0822cc69e624ec42f9d0abfd6e5ba177cb9bea40db0fe5ac89f6495958de2210

        • memory/456-1-0x0000015BD1A60000-0x0000015BD1A67000-memory.dmp

          Filesize

          28KB

        • memory/456-0-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/456-7-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/648-85-0x0000026967C40000-0x0000026967C47000-memory.dmp

          Filesize

          28KB

        • memory/648-91-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/1580-104-0x00000267E74F0000-0x00000267E76E9000-memory.dmp

          Filesize

          2.0MB

        • memory/1580-110-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/1580-106-0x00000267E73A0000-0x00000267E73A7000-memory.dmp

          Filesize

          28KB

        • memory/3552-36-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-29-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-16-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-20-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-25-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-30-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-32-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-34-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-37-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-40-0x0000000000C10000-0x0000000000C17000-memory.dmp

          Filesize

          28KB

        • memory/3552-39-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-47-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-48-0x00007FF9C78E0000-0x00007FF9C78F0000-memory.dmp

          Filesize

          64KB

        • memory/3552-38-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-10-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-35-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-59-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-57-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-33-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-31-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-28-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-8-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-27-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-26-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-24-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-23-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-22-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-21-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-19-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-18-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-15-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-14-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-13-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-12-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-11-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-9-0x00007FF9C739A000-0x00007FF9C739B000-memory.dmp

          Filesize

          4KB

        • memory/3552-6-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-4-0x00000000025E0000-0x00000000025E1000-memory.dmp

          Filesize

          4KB

        • memory/3552-17-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4492-69-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/4492-74-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/4492-68-0x000001D69E690000-0x000001D69E697000-memory.dmp

          Filesize

          28KB