Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 15:15

General

  • Target

    d577f77a0cf8344c9bb7d3be5578311b.dll

  • Size

    1.9MB

  • MD5

    d577f77a0cf8344c9bb7d3be5578311b

  • SHA1

    d150adc8a686a849c666159ab896fcc845fc6c00

  • SHA256

    95fc26f100d5508c34cd691e6e2e1d6cca2f621de4cd4769433e1564fc6f7e1f

  • SHA512

    a097092b1886bffcd6d963700f8ad88b0ac4e75f80979030eea65984d9e062d21a6a1b53dd62b16866b88a757449977198311e3040cbbd3db0b0c09cfa760319

  • SSDEEP

    12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d577f77a0cf8344c9bb7d3be5578311b.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2468
  • C:\Users\Admin\AppData\Local\dLcgJG\fveprompt.exe
    C:\Users\Admin\AppData\Local\dLcgJG\fveprompt.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:2572
  • C:\Windows\system32\fveprompt.exe
    C:\Windows\system32\fveprompt.exe
    1⤵
      PID:2556
    • C:\Users\Admin\AppData\Local\K6GtNFCS\msdtc.exe
      C:\Users\Admin\AppData\Local\K6GtNFCS\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2804
    • C:\Windows\system32\msdtc.exe
      C:\Windows\system32\msdtc.exe
      1⤵
        PID:2132
      • C:\Users\Admin\AppData\Local\f2F22\ComputerDefaults.exe
        C:\Users\Admin\AppData\Local\f2F22\ComputerDefaults.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1620
      • C:\Windows\system32\ComputerDefaults.exe
        C:\Windows\system32\ComputerDefaults.exe
        1⤵
          PID:1224

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Adobe\gd5\slc.dll

          Filesize

          1.9MB

          MD5

          ebc9d024bbe7ab6460ecf813aa807254

          SHA1

          d684f5a1cc0788aec9ee18ec55a10dbce3c14e34

          SHA256

          af92a3699e4170c14e7ef5e7f2204c13b17be8a78f69859923a3adfdfb8ff253

          SHA512

          3bfacc61c5a7a8d7186bb99fe2af069e06c1395992e4ac919aac0422ec6a11da0d06c141166af64eecdd7b6450ee49225ddfc73de03c4af415654dbb210c1888

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Cuhrqknkppepky.lnk

          Filesize

          1KB

          MD5

          c075f2402f617baa66a912c33b29e982

          SHA1

          a28c147d7d229547d4ff262e468e60e4f1f9b1d6

          SHA256

          be66c27e72cb0ea111779710a9d12820e7fbb9b7dfa0585bd799a0976b038c46

          SHA512

          795c973d17c8e181fe19b6d71b855a8205cfb660aaa59176dddd4f9d2ec47ae711932a1808933fae544eebba338950ad62faee5e13d39c045d3c8b651aa96674

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\fJkZdRhLSbg\VERSION.dll

          Filesize

          1.9MB

          MD5

          58fc7617bc31d466b4fff9c4ef58afc1

          SHA1

          39131a144c923f51dc84313aa6d97ee786a7329c

          SHA256

          641eb4e7c2acd77cfbaccd5fb664c419bae41bf88a3a936c29517635ede3f1dc

          SHA512

          5ba82d22cb1018eeb3f77e6e3297d1c392e88512b13e30f3a41a6bb7db6a89c4d333a5fceab981952640c89dd8abe44fd0951473546fd9530d414ba8c8410d49

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\KKn\appwiz.cpl

          Filesize

          1.9MB

          MD5

          86f95eaccbd73aa83f235161f7f726f2

          SHA1

          f6d1ca22b228496409b8cb02bd0413d9d051f909

          SHA256

          9c6b9c5f124e55ff9e1b74005c4aed97ddf2ff6ec0dc3dbd5e2c65d56698fa23

          SHA512

          2bff1c540dc40955b8a870e572f86d20371ea50fa72fcab090780b0b77d275f228cd377487b18583f14bd28e594c4315568aba2a4020bfb758397a633672e141

        • memory/1204-25-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-10-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-34-0x0000000002E80000-0x0000000002E87000-memory.dmp

          Filesize

          28KB

        • memory/1204-43-0x0000000077580000-0x0000000077582000-memory.dmp

          Filesize

          8KB

        • memory/1204-42-0x0000000077421000-0x0000000077422000-memory.dmp

          Filesize

          4KB

        • memory/1204-52-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-41-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-58-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-5-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

          Filesize

          4KB

        • memory/1204-22-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-30-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-143-0x0000000077316000-0x0000000077317000-memory.dmp

          Filesize

          4KB

        • memory/1204-33-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-7-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-57-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-31-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-23-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-28-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-27-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-26-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-4-0x0000000077316000-0x0000000077317000-memory.dmp

          Filesize

          4KB

        • memory/1204-24-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-21-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-16-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-29-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-20-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-19-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-18-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-17-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-15-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-14-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-13-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-12-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-11-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-32-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1204-9-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/1620-124-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1620-119-0x0000000000200000-0x0000000000207000-memory.dmp

          Filesize

          28KB

        • memory/2468-8-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/2468-0-0x0000000140000000-0x00000001401F2000-memory.dmp

          Filesize

          1.9MB

        • memory/2468-1-0x0000000001D90000-0x0000000001D97000-memory.dmp

          Filesize

          28KB

        • memory/2572-70-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/2572-72-0x0000000000280000-0x0000000000287000-memory.dmp

          Filesize

          28KB

        • memory/2572-75-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/2804-94-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/2804-99-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB