Analysis

  • max time kernel
    132s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 15:14

General

  • Target

    d5124b4f11f73e615ab6573dc5bb02cf.dll

  • Size

    1.9MB

  • MD5

    d5124b4f11f73e615ab6573dc5bb02cf

  • SHA1

    8a2f582744a0cdca0d21e40ce81f2ce3067c8bee

  • SHA256

    9b64a70112f7e8f285ac2c020036d4fa5d3cc529daf0fbbfefab39630ec50a2b

  • SHA512

    889ca16bb6fdd0a1677111c340cf67f29d3b0d305ed5ced6e4a4ed129b1828cc72021b9544b8f545c534671be11034e50d40596a6924ebe024c6cfa800495451

  • SSDEEP

    12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1K:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d5124b4f11f73e615ab6573dc5bb02cf.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1092
  • C:\Windows\system32\ProximityUxHost.exe
    C:\Windows\system32\ProximityUxHost.exe
    1⤵
      PID:3580
    • C:\Users\Admin\AppData\Local\6Hc\ProximityUxHost.exe
      C:\Users\Admin\AppData\Local\6Hc\ProximityUxHost.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:696
    • C:\Windows\system32\wusa.exe
      C:\Windows\system32\wusa.exe
      1⤵
        PID:2500
      • C:\Windows\system32\wbengine.exe
        C:\Windows\system32\wbengine.exe
        1⤵
          PID:3516
        • C:\Users\Admin\AppData\Local\n7k6haF\wbengine.exe
          C:\Users\Admin\AppData\Local\n7k6haF\wbengine.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:412
        • C:\Users\Admin\AppData\Local\S7gSC6\wusa.exe
          C:\Users\Admin\AppData\Local\S7gSC6\wusa.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:4880

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

          Filesize

          1KB

          MD5

          652fcdef80b39a9d1cd509a1cb00bb20

          SHA1

          40e67d0f558c19b01c0679c1d46cc54dc8fbd324

          SHA256

          4c60f836a04256ef9a80ee937f06389779ff9bca785a72afd658b28598456110

          SHA512

          309aa692df7224e71861be8b3d0005c9577f116de3a1cba1947788d2f7bcd0ccbf13dcf71968261bdc6902e02702047c45c8401aff6ecd6f8a1786e8c6482508

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\X5\WINMM.dll

          Filesize

          19KB

          MD5

          a660813d06e7e2292c96fc9bb13e8959

          SHA1

          3bf5c0a56c40192dc6d776a95dc9c5e883cd6d10

          SHA256

          c5e9408408dd2e67113824e2615eaf92365502be73867d20fd1747cd4ea3aa5a

          SHA512

          161cd0eb8877c2a65f4f3eaa5a05b8ff2685febf2d64325ce13e9d071d7dfab2aae69897a45bb3baf354912b2a5490ef7a27b27b4426d0fd22d1f3403897813f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\tz4p\SPP.dll

          Filesize

          56KB

          MD5

          4f2fb7eb689f8c15ead53f9454586c97

          SHA1

          b9994397f9d6ad3bc9b3d6925c2c82149e8220fb

          SHA256

          253a7336f0641bd938211640b2a4c997a9fb45ba05803239e563ee7a35164046

          SHA512

          fca80f9fad9da9f0828d14e543da1d597b4f90429dcf6927015e6add97dee7635adc010978946bf3001a2580af83f1bbeedb560ee93634e3279964480ee69b56

        • C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\nHb5\dpx.dll

          Filesize

          92KB

          MD5

          b6a93ec51b0536a7566dca777213709d

          SHA1

          3af4759225446c9061a551633929fbda86a62b14

          SHA256

          1c5e9fa19f7f55c6960dca8a1890c712931b7c52492ed33057f76477ed69fc1e

          SHA512

          146229aa4a190868dd18c1f829de6e6d4dca18b6801b0ff3b7a8761175ee38c96405810b87dc0faaa7af7b624aa38c97274a643edce8570ed814c9adff618ba1

        • memory/412-111-0x0000024E2DB00000-0x0000024E2DB07000-memory.dmp

          Filesize

          28KB

        • memory/696-76-0x0000022049460000-0x0000022049467000-memory.dmp

          Filesize

          28KB

        • memory/696-82-0x0000000140000000-0x00000001401EF000-memory.dmp

          Filesize

          1.9MB

        • memory/696-77-0x0000000140000000-0x00000001401EF000-memory.dmp

          Filesize

          1.9MB

        • memory/1092-1-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/1092-0-0x0000000000B00000-0x0000000000B07000-memory.dmp

          Filesize

          28KB

        • memory/1092-7-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-67-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-40-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-27-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-28-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-29-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-31-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-34-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-35-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-36-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-39-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-43-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-46-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-48-0x0000000001FF0000-0x0000000001FF7000-memory.dmp

          Filesize

          28KB

        • memory/3540-47-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-45-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-55-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-56-0x00007FFD10760000-0x00007FFD10770000-memory.dmp

          Filesize

          64KB

        • memory/3540-44-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-24-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-65-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-23-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-19-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-14-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-42-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-41-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-25-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-4-0x0000000002050000-0x0000000002051000-memory.dmp

          Filesize

          4KB

        • memory/3540-6-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-8-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-38-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-37-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-33-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-32-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-30-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-26-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-22-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-21-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-20-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-18-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-17-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-16-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-15-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-13-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-12-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-11-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-10-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/3540-9-0x00007FFD0F4DA000-0x00007FFD0F4DB000-memory.dmp

          Filesize

          4KB

        • memory/4880-93-0x0000000140000000-0x00000001401EE000-memory.dmp

          Filesize

          1.9MB

        • memory/4880-94-0x0000012753A20000-0x0000012753A27000-memory.dmp

          Filesize

          28KB