Analysis

  • max time kernel
    3s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 15:58

General

  • Target

    e3ddd19537fbfe6e4dd6fd445c3f6e3c.dll

  • Size

    1.5MB

  • MD5

    e3ddd19537fbfe6e4dd6fd445c3f6e3c

  • SHA1

    f9a944568c74a806d93ce6315e0db57dc5cbd86b

  • SHA256

    688f0f9ec8429037d5775788166500e6dac955c36caa2eab4e6b16d88c07d370

  • SHA512

    0320184082b47982b2fdec30094002cdbed0cebaf83299fa089a612d06117581f7206116ac76e656674e8c08d6f55db890465b7b4ee53687d1e901fadc2cfb1c

  • SSDEEP

    12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3ddd19537fbfe6e4dd6fd445c3f6e3c.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:816
  • C:\Windows\system32\dccw.exe
    C:\Windows\system32\dccw.exe
    1⤵
      PID:2612
    • C:\Users\Admin\AppData\Local\XzGD5YI\dccw.exe
      C:\Users\Admin\AppData\Local\XzGD5YI\dccw.exe
      1⤵
        PID:1936
      • C:\Windows\system32\psr.exe
        C:\Windows\system32\psr.exe
        1⤵
          PID:2780
        • C:\Users\Admin\AppData\Local\ySWKfy\psr.exe
          C:\Users\Admin\AppData\Local\ySWKfy\psr.exe
          1⤵
            PID:2004
          • C:\Users\Admin\AppData\Local\K58Q\TpmInit.exe
            C:\Users\Admin\AppData\Local\K58Q\TpmInit.exe
            1⤵
              PID:2884
            • C:\Windows\system32\TpmInit.exe
              C:\Windows\system32\TpmInit.exe
              1⤵
                PID:2000
              • C:\Users\Admin\AppData\Local\2Gl6lrSql\msra.exe
                C:\Users\Admin\AppData\Local\2Gl6lrSql\msra.exe
                1⤵
                  PID:2212
                • C:\Windows\system32\msra.exe
                  C:\Windows\system32\msra.exe
                  1⤵
                    PID:676

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/816-0-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/816-1-0x0000000000190000-0x0000000000197000-memory.dmp

                    Filesize

                    28KB

                  • memory/816-8-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-33-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-10-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-9-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-22-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-39-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-46-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-54-0x0000000002EE0000-0x0000000002EE7000-memory.dmp

                    Filesize

                    28KB

                  • memory/1208-57-0x00000000773B0000-0x00000000773B2000-memory.dmp

                    Filesize

                    8KB

                  • memory/1208-66-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-72-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-75-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-56-0x0000000077251000-0x0000000077252000-memory.dmp

                    Filesize

                    4KB

                  • memory/1208-55-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-47-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-45-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-44-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-43-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-42-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-41-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-40-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-38-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-37-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-36-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-35-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-32-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-4-0x0000000077146000-0x0000000077147000-memory.dmp

                    Filesize

                    4KB

                  • memory/1208-34-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-31-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-5-0x0000000003D70000-0x0000000003D71000-memory.dmp

                    Filesize

                    4KB

                  • memory/1208-29-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-28-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-27-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-26-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-25-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-24-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-23-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-21-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-20-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-19-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-18-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-17-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-16-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-15-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-14-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-13-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-12-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-11-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-30-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-7-0x0000000140000000-0x0000000140183000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1208-181-0x0000000077146000-0x0000000077147000-memory.dmp

                    Filesize

                    4KB

                  • memory/1936-86-0x0000000000280000-0x0000000000287000-memory.dmp

                    Filesize

                    28KB

                  • memory/2004-110-0x0000000000100000-0x0000000000107000-memory.dmp

                    Filesize

                    28KB

                  • memory/2212-153-0x0000000000180000-0x0000000000187000-memory.dmp

                    Filesize

                    28KB