Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 16:34

General

  • Target

    f334c05455a23f89ee06fb59f1b9f77f.dll

  • Size

    3.5MB

  • MD5

    f334c05455a23f89ee06fb59f1b9f77f

  • SHA1

    33410197fc64415e351f489720b48f0cc6ff401b

  • SHA256

    0692471fb02d58c1e50832d9f74be4e0a1155b1de0d434d5c4d38f644abe1d79

  • SHA512

    4c97f8d362f8256c9a2abf0785d96ceb82e451e23533aa007346f88f3f27776bee16c27fc2c76b7d09cb772f9138b1750d651c1cbbba478d8e40b87efcb07e01

  • SSDEEP

    12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f334c05455a23f89ee06fb59f1b9f77f.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2424
  • C:\Windows\system32\SnippingTool.exe
    C:\Windows\system32\SnippingTool.exe
    1⤵
      PID:2908
    • C:\Users\Admin\AppData\Local\cLsFocb\SnippingTool.exe
      C:\Users\Admin\AppData\Local\cLsFocb\SnippingTool.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2924
    • C:\Windows\system32\BitLockerWizard.exe
      C:\Windows\system32\BitLockerWizard.exe
      1⤵
        PID:2964
      • C:\Users\Admin\AppData\Local\QMJ53\BitLockerWizard.exe
        C:\Users\Admin\AppData\Local\QMJ53\BitLockerWizard.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1956
      • C:\Windows\system32\sigverif.exe
        C:\Windows\system32\sigverif.exe
        1⤵
          PID:916
        • C:\Users\Admin\AppData\Local\cQIVF7e\sigverif.exe
          C:\Users\Admin\AppData\Local\cQIVF7e\sigverif.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:928
        • C:\Windows\system32\dvdupgrd.exe
          C:\Windows\system32\dvdupgrd.exe
          1⤵
            PID:2156
          • C:\Users\Admin\AppData\Local\PggLtF\dvdupgrd.exe
            C:\Users\Admin\AppData\Local\PggLtF\dvdupgrd.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:1952

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\PggLtF\VERSION.dll

            Filesize

            704KB

            MD5

            6bdba44719d3a934ebff5a49d04d6347

            SHA1

            b3f29162adaa8eef2617bc4052811523b0c1827e

            SHA256

            8dffb790ce89316311fc9e641e5e22c9007d897c7e6be67fb83c873de7187cd0

            SHA512

            0dcf943f35f988acda9675b9678693f304bd328f3699de3734cb9359d8cff34d94b3ea51c090828e313a66ea16903a36945fef2b67f56982dfd0c76337326841

          • C:\Users\Admin\AppData\Local\QMJ53\FVEWIZ.dll

            Filesize

            3.5MB

            MD5

            65359269f67fb316fe9484ce959d93f0

            SHA1

            f8f173bd9a205f69321ea4029cc680488f193cde

            SHA256

            2b909ad13b0bbcda99df41e89c1a6ddce52d5b5d07812a32d22fed0cb79b4d20

            SHA512

            2fa7ca59eee70c98baeec75a85a75810e4362638beb4f9ce63b26d5f9f5948dde4fe9ca536ffd9220af8c59070716e01b1ed1097c9bf41f78e5ba4570d6ac1db

          • C:\Users\Admin\AppData\Local\cLsFocb\OLEACC.dll

            Filesize

            3.5MB

            MD5

            98a0e73843d805b792047f376a59c7af

            SHA1

            c5796f255c566626c2d224795eb7141ae505cade

            SHA256

            7ddc75fec7449869b55a16f2e2b97f273969b5e2a10725200e05b989c181d7e7

            SHA512

            cd2e515544c37c15eacd3d61f3d4b8a75dcade984e37728d07832c4323d7bde6f6e425de7bb55b83aea8a058dfef78975d837bc697fbbc8038a69b117579d7f2

          • C:\Users\Admin\AppData\Local\cQIVF7e\VERSION.dll

            Filesize

            3.5MB

            MD5

            f43ff900da2ce28117d76e11440d3df0

            SHA1

            b367e84a2b2b157e9b7d8caa55f28f26dd8129c7

            SHA256

            e0bde37571c8cd9ce746abd8a3ae82d779f335ca1ae3f1b41c9427574b501fcc

            SHA512

            28c6b77372ad04bdba9ad51ef2b8ad8c6d7911f2f248e1a1c4152d7cdde5c196aa54894c95dcaedae5e0aa0b8cb55f8354de4fab0c154ec05d28a391d6c89edd

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

            Filesize

            701B

            MD5

            d154c9b0d95c903fe7fe0299b2cd8bb2

            SHA1

            aeb7f4642fefcad87f18b82587c3f7e0209f113a

            SHA256

            bf66068f324347f8e61c489c4680269a9ad2cfea418521f88d1181aa170beeaa

            SHA512

            d650d105deb1ba3cfc604c02dc693f57c007f0c87ef9385333c8b08588fdfd0f7e4dc2e323eb0ddf8aa67e941c6048ae7f47d9d67f410395f38a610e081fe1eb

          • \Users\Admin\AppData\Local\PggLtF\VERSION.dll

            Filesize

            3.5MB

            MD5

            aaaebd5837f2d85091c81431c9bbabe8

            SHA1

            508b5b793f71cacd6924968fc65f270c59d5119f

            SHA256

            18b029ec15649417b76ae923b40dca7e21a02ad2bb28b4ce7a6332596574b2e4

            SHA512

            3e2e96889f530d6b1515b9d50e079a8dd2b280b1b1e1c5036e706f2597f7a30a45002c230a5a9c38bd15a0caa18b35acd02247ed631ccd1f2942834ce05bb25a

          • \Users\Admin\AppData\Local\PggLtF\dvdupgrd.exe

            Filesize

            25KB

            MD5

            75a9b4172eac01d9648c6d2133af952f

            SHA1

            63c7e1af762d2b584e9cc841e8b0100f2a482b81

            SHA256

            18f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736

            SHA512

            5a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769

          • \Users\Admin\AppData\Local\QMJ53\BitLockerWizard.exe

            Filesize

            98KB

            MD5

            08a761595ad21d152db2417d6fdb239a

            SHA1

            d84c1bc2e8c9afce9fb79916df9bca169f93a936

            SHA256

            ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620

            SHA512

            8b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9

          • \Users\Admin\AppData\Local\cLsFocb\SnippingTool.exe

            Filesize

            421KB

            MD5

            7633f554eeafde7f144b41c2fcaf5f63

            SHA1

            44497c3d6fada0066598a6170b90c53e28ddf96c

            SHA256

            890884c7fe7d037e6debd21d1877e9c9c5e7790cdba007ddb219ae6a55667f78

            SHA512

            7b61b6736c2c4f49d80f53c839914ad845f86a7d921fee1557e49aa7b4e9713e3483417d6c717eca155229bb6a90fc2253e1543cf05192aaf08262dc761fa203

          • \Users\Admin\AppData\Local\cQIVF7e\sigverif.exe

            Filesize

            73KB

            MD5

            e8e95ae5534553fc055051cee99a7f55

            SHA1

            4e0f668849fd546edd083d5981ed685d02a68df4

            SHA256

            9e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec

            SHA512

            5d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6

          • memory/928-135-0x0000000000320000-0x0000000000327000-memory.dmp

            Filesize

            28KB

          • memory/1380-46-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-52-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-19-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-20-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-21-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-23-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-22-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-24-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-25-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-26-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-27-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-29-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-28-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-30-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-31-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-32-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-33-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-34-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-35-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-36-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-37-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-38-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-39-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-41-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-40-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-42-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-43-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-44-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-45-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-4-0x0000000077296000-0x0000000077297000-memory.dmp

            Filesize

            4KB

          • memory/1380-47-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-48-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-49-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-50-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-51-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-18-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-53-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-54-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-55-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-56-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-57-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-58-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-59-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-60-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-61-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-63-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-62-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-64-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-66-0x0000000002250000-0x0000000002257000-memory.dmp

            Filesize

            28KB

          • memory/1380-65-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-74-0x00000000774A1000-0x00000000774A2000-memory.dmp

            Filesize

            4KB

          • memory/1380-75-0x0000000077600000-0x0000000077602000-memory.dmp

            Filesize

            8KB

          • memory/1380-17-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-16-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-101-0x0000000077296000-0x0000000077297000-memory.dmp

            Filesize

            4KB

          • memory/1380-5-0x0000000002650000-0x0000000002651000-memory.dmp

            Filesize

            4KB

          • memory/1380-7-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-9-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-10-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-15-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-14-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-11-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-13-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1380-12-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/1952-153-0x0000000001B40000-0x0000000001B47000-memory.dmp

            Filesize

            28KB

          • memory/1956-117-0x0000000000100000-0x0000000000107000-memory.dmp

            Filesize

            28KB

          • memory/2424-8-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/2424-1-0x0000000140000000-0x000000014037E000-memory.dmp

            Filesize

            3.5MB

          • memory/2424-0-0x0000000000190000-0x0000000000197000-memory.dmp

            Filesize

            28KB

          • memory/2924-103-0x0000000000280000-0x0000000000287000-memory.dmp

            Filesize

            28KB