Analysis

  • max time kernel
    62s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 17:08

General

  • Target

    fb8ef1d9b849463e08f469bc0ab5ab58.dll

  • Size

    2.9MB

  • MD5

    fb8ef1d9b849463e08f469bc0ab5ab58

  • SHA1

    732ed4aaebbfce62885e91d1e76bfe60327a4454

  • SHA256

    19988509d5eafd5dbd7ece29cfbe82adec569eea950c757aca5053e34c0ab652

  • SHA512

    c77e066d96627df6d7ff281ca026683d32c96e13b702a27eb39a84524f816d685969c32cf70ae25af56d27a8a07a11f9da32885675dfd896bc7b7cacab4eb954

  • SSDEEP

    12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8ef1d9b849463e08f469bc0ab5ab58.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4308
  • C:\Windows\system32\EaseOfAccessDialog.exe
    C:\Windows\system32\EaseOfAccessDialog.exe
    1⤵
      PID:3444
    • C:\Users\Admin\AppData\Local\kLCxF\EaseOfAccessDialog.exe
      C:\Users\Admin\AppData\Local\kLCxF\EaseOfAccessDialog.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4336
    • C:\Windows\system32\wscript.exe
      C:\Windows\system32\wscript.exe
      1⤵
        PID:4140
      • C:\Users\Admin\AppData\Local\T5yJOKTt5\wscript.exe
        C:\Users\Admin\AppData\Local\T5yJOKTt5\wscript.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4592
      • C:\Windows\system32\dwm.exe
        C:\Windows\system32\dwm.exe
        1⤵
          PID:644
        • C:\Users\Admin\AppData\Local\ugamhhU\dwm.exe
          C:\Users\Admin\AppData\Local\ugamhhU\dwm.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3328

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

          Filesize

          1KB

          MD5

          491b00d841270ff775380a96094227f9

          SHA1

          740de435a8ccb85620e22065afec80889c4f108c

          SHA256

          06a396676bae7cb0c5b785b80cb2207f0fdc56796a04128110689bd2008a1cc9

          SHA512

          075bd44f44590e7da3357ac55f3829723164df8746cc57b94deae8515742f1f49198755369fac0ae64c7c33c0021c0df225f269684f45531d5c99d0692cd3bc4

        • C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\3QrB4\OLEACC.dll

          Filesize

          63KB

          MD5

          d212d026e6fb7643def7dcd1723b501c

          SHA1

          1ab54c8c1ad60e4350c6029ce4c738e90e0f67cc

          SHA256

          3424209deee7a833fc5e504d37ed282a5f287cd600dce1bffaa46b2ed78245b0

          SHA512

          be3eb83bc0f375c838c96e221a29a7a23dfa39c5b685dabb7cec9407171458c713d9adbce8feb2ff5a3ea99b7e011ec0de63e14031b36558bc3a49bfd94f148d

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\7xBJqBz\dxgi.dll

          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\IVdzMcn\VERSION.dll

          Filesize

          106KB

          MD5

          331e98defeb6cc255eb8f24afe44957b

          SHA1

          2fc7da85b0bc6194f8eec81a1156be7582710a4c

          SHA256

          29e5d85b84dd1b7791d5f5892d786491b24a9e780924232e4c9a4e94c08973df

          SHA512

          6be0e98269fb019c86a9ee7016ad6b1c8a500279255c390188e4374ef81c63e2f083d682c09fe30cc3287478dc2fafd3b6bd0270eb440a0553b89cc3289fc9db

        • memory/3328-135-0x000001D514940000-0x000001D514947000-memory.dmp

          Filesize

          28KB

        • memory/3420-61-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-39-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-14-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-7-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-18-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-20-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-19-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-59-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-25-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-27-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-30-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-33-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-36-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-77-0x00007FF9F22C0000-0x00007FF9F22D0000-memory.dmp

          Filesize

          64KB

        • memory/3420-43-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-44-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-47-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-58-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-48-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-50-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-51-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-53-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-52-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-55-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-57-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-60-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-63-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-65-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-64-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-69-0x00000000008D0000-0x00000000008D7000-memory.dmp

          Filesize

          28KB

        • memory/3420-62-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-5-0x00007FF9F182A000-0x00007FF9F182B000-memory.dmp

          Filesize

          4KB

        • memory/3420-22-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-13-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-49-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-56-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-54-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-46-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-45-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-42-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-41-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-4-0x0000000002260000-0x0000000002261000-memory.dmp

          Filesize

          4KB

        • memory/3420-9-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-10-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-11-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-40-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-38-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-37-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-35-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-34-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-32-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-16-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-31-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-29-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-12-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-28-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-26-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-23-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-24-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-21-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-17-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/3420-15-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/4308-8-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/4308-1-0x0000000140000000-0x00000001402E5000-memory.dmp

          Filesize

          2.9MB

        • memory/4308-0-0x0000025E96810000-0x0000025E96817000-memory.dmp

          Filesize

          28KB

        • memory/4336-97-0x0000025DA8260000-0x0000025DA8267000-memory.dmp

          Filesize

          28KB

        • memory/4592-114-0x000001D4633B0000-0x000001D4633B7000-memory.dmp

          Filesize

          28KB