Analysis

  • max time kernel
    139s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 16:33

General

  • Target

    f31c9ea6eaecfbc1d3581dd755a4944f.dll

  • Size

    2.3MB

  • MD5

    f31c9ea6eaecfbc1d3581dd755a4944f

  • SHA1

    94d3949951aa11a15bb76f8186612568117086ea

  • SHA256

    c52b166abcd2b1f2055342f5e28d79527a621c723f52a0a2b0ea9e55d3e46136

  • SHA512

    3036a7c406a530486e7b26d1499103bca0fcd14769856b5bd0aa1a983e07004d4301d5e7b2b8b78936e67d5099dac66e4887dce3cec6ce4a89688f381f372c5a

  • SSDEEP

    12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1cNeu:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f31c9ea6eaecfbc1d3581dd755a4944f.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1044
  • C:\Users\Admin\AppData\Local\7LX8P8\shrpubw.exe
    C:\Users\Admin\AppData\Local\7LX8P8\shrpubw.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:2468
  • C:\Windows\system32\shrpubw.exe
    C:\Windows\system32\shrpubw.exe
    1⤵
      PID:2688
    • C:\Users\Admin\AppData\Local\OnV\sethc.exe
      C:\Users\Admin\AppData\Local\OnV\sethc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1880
    • C:\Windows\system32\sethc.exe
      C:\Windows\system32\sethc.exe
      1⤵
        PID:2996
      • C:\Users\Admin\AppData\Local\u8J7mTo\xpsrchvw.exe
        C:\Users\Admin\AppData\Local\u8J7mTo\xpsrchvw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1664
      • C:\Windows\system32\xpsrchvw.exe
        C:\Windows\system32\xpsrchvw.exe
        1⤵
          PID:1656

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1044-0-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1044-1-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/1044-8-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-4-0x00000000776D6000-0x00000000776D7000-memory.dmp

          Filesize

          4KB

        • memory/1312-12-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-23-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-34-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-45-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-48-0x0000000002EF0000-0x0000000002EF7000-memory.dmp

          Filesize

          28KB

        • memory/1312-57-0x0000000077940000-0x0000000077942000-memory.dmp

          Filesize

          8KB

        • memory/1312-56-0x00000000777E1000-0x00000000777E2000-memory.dmp

          Filesize

          4KB

        • memory/1312-66-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-72-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-75-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-55-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-47-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-46-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-44-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-43-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-42-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-41-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-40-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-39-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-38-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-37-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-36-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-35-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-33-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-32-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-31-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-30-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-29-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-28-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-27-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-26-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-25-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-24-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-22-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-21-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-20-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-19-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-18-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-17-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-16-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-15-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-14-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-13-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-11-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-10-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-9-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-7-0x0000000140000000-0x000000014024B000-memory.dmp

          Filesize

          2.3MB

        • memory/1312-5-0x0000000002F10000-0x0000000002F11000-memory.dmp

          Filesize

          4KB

        • memory/1312-161-0x00000000776D6000-0x00000000776D7000-memory.dmp

          Filesize

          4KB

        • memory/1664-132-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB