Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 16:12

General

  • Target

    eaf0253303d762297bfe8a16d4011c06.dll

  • Size

    2.1MB

  • MD5

    eaf0253303d762297bfe8a16d4011c06

  • SHA1

    0d4f0dadb228828861593e2582044e6160edd443

  • SHA256

    eee23c7594dadc97d779a835a31eaa189bcbb14273cdffebc64e7fef7e5ff036

  • SHA512

    ea25b83a26e1a07782c6a88828ddc437bca8659429163ae21f53025e6f253f314244851acf176ed31746e6cd1a5e36f5186d91e531d25ee35dcb17c732e8ab9f

  • SSDEEP

    12288:hVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:QfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\eaf0253303d762297bfe8a16d4011c06.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4460
  • C:\Windows\system32\ApplicationFrameHost.exe
    C:\Windows\system32\ApplicationFrameHost.exe
    1⤵
      PID:2316
    • C:\Users\Admin\AppData\Local\Bg7M\ApplicationFrameHost.exe
      C:\Users\Admin\AppData\Local\Bg7M\ApplicationFrameHost.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4568
    • C:\Users\Admin\AppData\Local\09WwKjxp\SystemPropertiesPerformance.exe
      C:\Users\Admin\AppData\Local\09WwKjxp\SystemPropertiesPerformance.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2132
    • C:\Windows\system32\SystemPropertiesPerformance.exe
      C:\Windows\system32\SystemPropertiesPerformance.exe
      1⤵
        PID:3844
      • C:\Users\Admin\AppData\Local\wKxM8\shrpubw.exe
        C:\Users\Admin\AppData\Local\wKxM8\shrpubw.exe
        1⤵
          PID:3032
        • C:\Windows\system32\shrpubw.exe
          C:\Windows\system32\shrpubw.exe
          1⤵
            PID:952
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3032

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2132-120-0x000001CF8C110000-0x000001CF8C117000-memory.dmp

            Filesize

            28KB

          • memory/3032-103-0x000002DF18020000-0x000002DF18027000-memory.dmp

            Filesize

            28KB

          • memory/3444-40-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-38-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-29-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-35-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-39-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-47-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-52-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-56-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-58-0x0000000000A90000-0x0000000000A97000-memory.dmp

            Filesize

            28KB

          • memory/3444-65-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-57-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-75-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-4-0x0000000002470000-0x0000000002471000-memory.dmp

            Filesize

            4KB

          • memory/3444-15-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-6-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-66-0x00007FF915260000-0x00007FF915270000-memory.dmp

            Filesize

            64KB

          • memory/3444-55-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-54-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-53-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-51-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-50-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-49-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-48-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-46-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-45-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-44-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-43-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-42-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-8-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-41-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-22-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-37-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-36-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-34-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-33-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-32-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-31-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-30-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-28-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-27-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-26-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-25-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-24-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-23-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-21-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-20-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-19-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-18-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-17-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-16-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-14-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-13-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-12-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-11-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-10-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/3444-9-0x00007FF913FCA000-0x00007FF913FCB000-memory.dmp

            Filesize

            4KB

          • memory/4460-7-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/4460-0-0x0000000140000000-0x0000000140210000-memory.dmp

            Filesize

            2.1MB

          • memory/4460-2-0x00000195875C0000-0x00000195875C7000-memory.dmp

            Filesize

            28KB

          • memory/4568-86-0x000001DC8A060000-0x000001DC8A067000-memory.dmp

            Filesize

            28KB