Analysis

  • max time kernel
    107s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 15:44

General

  • Target

    df0708fcf553fdf7b27a1591a96257db.dll

  • Size

    2.0MB

  • MD5

    df0708fcf553fdf7b27a1591a96257db

  • SHA1

    cb8d06051f06b38cba24df4ccf676c1be7090484

  • SHA256

    6dffce1ea68f5480f850e4b067f15d5950bca8d75f8d1a4b70059e11c0e02445

  • SHA512

    11ec4c936d13c08215f41a023f3846773aabfa0cc89d35cf2674cc9072e51537fc147b690a1bbb7d4fa1c845eed35345cf78ad43acde8cb8e55e612509d524d6

  • SSDEEP

    12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1xx:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\df0708fcf553fdf7b27a1591a96257db.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4052
  • C:\Windows\system32\rdpinit.exe
    C:\Windows\system32\rdpinit.exe
    1⤵
      PID:4588
    • C:\Users\Admin\AppData\Local\BfR\rdpinit.exe
      C:\Users\Admin\AppData\Local\BfR\rdpinit.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2976
    • C:\Windows\system32\sessionmsg.exe
      C:\Windows\system32\sessionmsg.exe
      1⤵
        PID:3404
      • C:\Users\Admin\AppData\Local\oKit\sessionmsg.exe
        C:\Users\Admin\AppData\Local\oKit\sessionmsg.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4576
      • C:\Windows\system32\rdpclip.exe
        C:\Windows\system32\rdpclip.exe
        1⤵
          PID:2096
        • C:\Users\Admin\AppData\Local\wDwAK7eTt\rdpclip.exe
          C:\Users\Admin\AppData\Local\wDwAK7eTt\rdpclip.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3552

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

          Filesize

          979B

          MD5

          9c5846b2ef41404ebe9bc92f7d44ec88

          SHA1

          81c091f00fc271ed09447203dbb076aa052f81aa

          SHA256

          9e46888e3cafde71a2844fddf7c1133641848ba53c664b1e35b78dcabfee6806

          SHA512

          f5f7490bd79753deb66becf21c037c1043b9fd73ee482e47f0e6cd68496d08727c5ca946176b22caae01798ee5f0585497e5c8ec99292a5b7dfd4c29e0f490ff

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\XX\WINSTA.dll

          Filesize

          35KB

          MD5

          1dc4773c79706f31955fec51b6659738

          SHA1

          79ae74552b413b0d589b04dc4b96eb614bed2a54

          SHA256

          22bb5fd5c14406ee26c5165109d0ac94d546f38142f43b56139b61a2bc5cffc7

          SHA512

          7c25d5e4277662005ce8aa60f464ed3551cb92c087bb4e7462b171934dbc827f2323a7f426f6449fce6e740fefe5a2434753dddf5226605b1c1e31b679293f5c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DnIua\DUI70.dll

          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • C:\Users\Admin\AppData\Roaming\Mozilla\dcsjF\WTSAPI32.dll

          Filesize

          189KB

          MD5

          e57944510f4c8b095dfa0c68d8666e76

          SHA1

          3e2b9ce9b3e7989d71f27bc4983e56fc3394bf78

          SHA256

          a70bacb1497a441cfd9121608c2a312f93d3663374890934d8f321424ca83638

          SHA512

          fa2db2ff7c5caf78bf690fab72e8a17ec7a93760da86167364924952e68a1fc19222b7c4c430bb808ecee0a706423d82396629d48a2a661c43523d510e93e60a

        • memory/2976-63-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/2976-62-0x000002A411720000-0x000002A411727000-memory.dmp

          Filesize

          28KB

        • memory/2976-68-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-31-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-16-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-21-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-24-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-27-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-4-0x0000000001560000-0x0000000001561000-memory.dmp

          Filesize

          4KB

        • memory/3412-34-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-33-0x00000000013D0000-0x00000000013D7000-memory.dmp

          Filesize

          28KB

        • memory/3412-41-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-32-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-42-0x00007FFEF4640000-0x00007FFEF4650000-memory.dmp

          Filesize

          64KB

        • memory/3412-30-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-28-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-29-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-26-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-25-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-23-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-22-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-20-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-19-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-17-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-18-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-15-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-12-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-13-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-11-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-6-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-53-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-51-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-14-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-10-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-9-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/3412-8-0x00007FFEF411A000-0x00007FFEF411B000-memory.dmp

          Filesize

          4KB

        • memory/3552-96-0x00000155C2000000-0x00000155C2007000-memory.dmp

          Filesize

          28KB

        • memory/3552-97-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3552-102-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4052-7-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/4052-1-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/4052-0-0x00000000009C0000-0x00000000009C7000-memory.dmp

          Filesize

          28KB

        • memory/4576-85-0x0000000140000000-0x000000014023D000-memory.dmp

          Filesize

          2.2MB

        • memory/4576-79-0x0000000140000000-0x000000014023D000-memory.dmp

          Filesize

          2.2MB

        • memory/4576-80-0x000001716F6B0000-0x000001716F6B7000-memory.dmp

          Filesize

          28KB