Analysis

  • max time kernel
    146s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 16:11

General

  • Target

    eac2738515d0292a80e97bdd871ae3f8.dll

  • Size

    1.4MB

  • MD5

    eac2738515d0292a80e97bdd871ae3f8

  • SHA1

    bd8ef231bfeb6635d869210f39b36f77b691c9e6

  • SHA256

    96761af2af2e82740682729fe36feb508fc90cdc60771957e4583f853a873709

  • SHA512

    c7033b905fd46d55c0dac1629905196c5c09d933957ac5ec13f496397b5a55fdb07a0821d93c394cc0f4b58b8af092ee54388552a7f8c58eb36b91c6083c8711

  • SSDEEP

    12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\eac2738515d0292a80e97bdd871ae3f8.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1764
  • C:\Windows\system32\msinfo32.exe
    C:\Windows\system32\msinfo32.exe
    1⤵
      PID:2812
    • C:\Users\Admin\AppData\Local\cM1j4\msinfo32.exe
      C:\Users\Admin\AppData\Local\cM1j4\msinfo32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2620
    • C:\Users\Admin\AppData\Local\BoH\calc.exe
      C:\Users\Admin\AppData\Local\BoH\calc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2152
    • C:\Windows\system32\calc.exe
      C:\Windows\system32\calc.exe
      1⤵
        PID:2120
      • C:\Users\Admin\AppData\Local\qeTlzB\cmstp.exe
        C:\Users\Admin\AppData\Local\qeTlzB\cmstp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2756
      • C:\Windows\system32\cmstp.exe
        C:\Windows\system32\cmstp.exe
        1⤵
          PID:1960

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\jqH\VERSION.dll

          Filesize

          1024KB

          MD5

          3a5e21b46e1772eccc1be463ecef31ef

          SHA1

          4a4d196683a88cb966b9eb6a3e429a4849a5b2b2

          SHA256

          9197b03a1d002005ba8fa73b05a0efdd46fdc0910eedc15c9b4fb1c8ed96a7b3

          SHA512

          c96962b4401baed60ff48ded1588fe7f323c8cd508544261403e697a6bb9656acd56f98fb209262e75881d8072bd01721c0e51f8535d91b511ebc9ddc3cb6bc8

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\8fjLlLS\UxTheme.dll

          Filesize

          1.4MB

          MD5

          1c7d843e641a9de9a7141569c55f5969

          SHA1

          43e5a3bea21e6dabb4617bf0276f2feb51282261

          SHA256

          1147e8241f901954a6515e9304cd00b64c942244971c54caeddba9727ffb2129

          SHA512

          d7977347b33cdef1bd93623281397c5c0be6d0b0e3ce70891e594d358ca38cef0179685048527bab54e7eef98ec4a634f21b4426d2334a33fa8722dffce87bcb

        • memory/1360-24-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-11-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-31-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-42-0x0000000002590000-0x0000000002597000-memory.dmp

          Filesize

          28KB

        • memory/1360-45-0x0000000077420000-0x0000000077422000-memory.dmp

          Filesize

          8KB

        • memory/1360-44-0x00000000772C1000-0x00000000772C2000-memory.dmp

          Filesize

          4KB

        • memory/1360-21-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-54-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-63-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-60-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-35-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-20-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-33-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-5-0x00000000025B0000-0x00000000025B1000-memory.dmp

          Filesize

          4KB

        • memory/1360-9-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-32-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-30-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-29-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-28-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-27-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-22-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-25-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-4-0x00000000770B6000-0x00000000770B7000-memory.dmp

          Filesize

          4KB

        • memory/1360-23-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-26-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-43-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-34-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-19-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-18-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-17-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-16-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-14-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-145-0x00000000770B6000-0x00000000770B7000-memory.dmp

          Filesize

          4KB

        • memory/1360-7-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-10-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-13-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-12-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1360-15-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1764-8-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1764-1-0x0000000140000000-0x000000014016A000-memory.dmp

          Filesize

          1.4MB

        • memory/1764-0-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2152-99-0x0000000000420000-0x0000000000427000-memory.dmp

          Filesize

          28KB

        • memory/2152-101-0x0000000140000000-0x000000014016B000-memory.dmp

          Filesize

          1.4MB

        • memory/2152-96-0x0000000140000000-0x000000014016B000-memory.dmp

          Filesize

          1.4MB

        • memory/2620-72-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/2620-77-0x0000000140000000-0x0000000140171000-memory.dmp

          Filesize

          1.4MB

        • memory/2620-73-0x0000000140000000-0x0000000140171000-memory.dmp

          Filesize

          1.4MB

        • memory/2756-125-0x0000000140000000-0x000000014016B000-memory.dmp

          Filesize

          1.4MB

        • memory/2756-122-0x0000000000090000-0x0000000000097000-memory.dmp

          Filesize

          28KB