Analysis

  • max time kernel
    112s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 16:27

General

  • Target

    efedcd108046b223d56049091b408298.dll

  • Size

    1.5MB

  • MD5

    efedcd108046b223d56049091b408298

  • SHA1

    b0c68d9918ab0bfc3b2a165eafb67a5dc5de9d35

  • SHA256

    1f4c47d15d65d51f2b6dd680a7318d3639e0cfbcad702ba30e93a4a301d1ac06

  • SHA512

    682aa16df911870f710d7468cd87af0885572a043209797d0d092316811644e194187fdcb523502f79d30d85fa959be955eb8072e2815130f5b596d96f540f10

  • SSDEEP

    12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\efedcd108046b223d56049091b408298.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4296
  • C:\Users\Admin\AppData\Local\G6u9N\psr.exe
    C:\Users\Admin\AppData\Local\G6u9N\psr.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:1764
  • C:\Windows\system32\psr.exe
    C:\Windows\system32\psr.exe
    1⤵
      PID:740
    • C:\Windows\system32\consent.exe
      C:\Windows\system32\consent.exe
      1⤵
        PID:4596
      • C:\Windows\system32\cmstp.exe
        C:\Windows\system32\cmstp.exe
        1⤵
          PID:1908
        • C:\Windows\system32\WMPDMC.exe
          C:\Windows\system32\WMPDMC.exe
          1⤵
            PID:3572
          • C:\Users\Admin\AppData\Local\nyjLiKKi\WMPDMC.exe
            C:\Users\Admin\AppData\Local\nyjLiKKi\WMPDMC.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:1868
          • C:\Users\Admin\AppData\Local\Po1\cmstp.exe
            C:\Users\Admin\AppData\Local\Po1\cmstp.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:4212
          • C:\Users\Admin\AppData\Local\sXDkX4\consent.exe
            C:\Users\Admin\AppData\Local\sXDkX4\consent.exe
            1⤵
            • Executes dropped EXE
            PID:3712

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

            Filesize

            1KB

            MD5

            5c24e5c416b6464e9adfd2ef9d01dfa3

            SHA1

            4cc4394a157a4f05f1dfe50798f039e12b92e098

            SHA256

            0073789a4c5f98836fa5c6aa23bdfb52bca5ee4cf225e136f9ed69f0f560c494

            SHA512

            9729639a659a86010e4e6bd790611c839844091efee25793ecaa723486245670cff20cab1237a577c47317de9498b477e0314b05122ff06a546a75f39cb4c86a

          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\RwC\dwmapi.dll

            Filesize

            476KB

            MD5

            c2aee7fa9af9979c0685facb8299592e

            SHA1

            77467de9dce252b3269b2dde2de1dd93cd430054

            SHA256

            53bd034cb1037dd238a0330c8bac414b7b56aa67d43fd359b6b13b785e8869a3

            SHA512

            f601d278e8c8ab9178894460b5cd6c53636018c40db87eea9ec5094f303303c778d319973f67b07e8f56a8fb0db3b5280996c3ce716ef827b1be5a715c29042e

          • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\dHPI5R8WWrB\VERSION.dll

            Filesize

            65KB

            MD5

            873d7c7365bf9d16f87288d53486c55a

            SHA1

            3d650722ae3a768e16ddf92c6f8414f5750a2ecf

            SHA256

            5170c71d21d18b619a818fd5757a239121d2fea4599c0e7cb66744b926aed809

            SHA512

            53e95bbd69a6d628863509d3c095f981fc61e5ec901712d3c51c7fee700e06431bcdfb3cb7ed9217d88f08e878064a8e30e1df359f0334bdb94f814740c4fe3f

          • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\T1vER\XmlLite.dll

            Filesize

            179KB

            MD5

            3241a80ef412b683e95bc61c2c435566

            SHA1

            68785fc1cb12f130868ba47810045ed5aa275bd4

            SHA256

            aabe43d3ec4514fc3db5e032b3b241c5a5e2aa7b641a907e997380d1a3186b46

            SHA512

            8b9ab43f84bacea22d26afdc8f519e7c301d7e1c47e94bd3da55151c4589262012763b81def64fa266c5b10f1fbecb90130f1ec58ff44b192bb444e935670529

          • memory/1764-75-0x000002871AAC0000-0x000002871AAC7000-memory.dmp

            Filesize

            28KB

          • memory/1764-80-0x0000000140000000-0x0000000140177000-memory.dmp

            Filesize

            1.5MB

          • memory/1764-74-0x0000000140000000-0x0000000140177000-memory.dmp

            Filesize

            1.5MB

          • memory/1868-117-0x000002A7FD500000-0x000002A7FD507000-memory.dmp

            Filesize

            28KB

          • memory/3592-29-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-26-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-43-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-44-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-46-0x0000000000D00000-0x0000000000D07000-memory.dmp

            Filesize

            28KB

          • memory/3592-45-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-42-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-41-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-39-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-53-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-38-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-54-0x00007FFC8DC60000-0x00007FFC8DC70000-memory.dmp

            Filesize

            64KB

          • memory/3592-37-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-35-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-65-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-63-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-34-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-33-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-31-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-30-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-36-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-14-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-18-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-32-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-28-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-40-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-25-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-24-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-22-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-21-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-19-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-20-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-17-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-16-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-15-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-13-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-12-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-11-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-10-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-8-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-23-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-27-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/3592-4-0x0000000002840000-0x0000000002841000-memory.dmp

            Filesize

            4KB

          • memory/3592-9-0x00007FFC8D66A000-0x00007FFC8D66B000-memory.dmp

            Filesize

            4KB

          • memory/3592-6-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/4212-106-0x0000000140000000-0x0000000140177000-memory.dmp

            Filesize

            1.5MB

          • memory/4212-100-0x000002237F4E0000-0x000002237F4E7000-memory.dmp

            Filesize

            28KB

          • memory/4296-7-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/4296-1-0x0000000140000000-0x0000000140176000-memory.dmp

            Filesize

            1.5MB

          • memory/4296-0-0x0000016587EE0000-0x0000016587EE7000-memory.dmp

            Filesize

            28KB