Analysis

  • max time kernel
    138s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 07:52

General

  • Target

    103bce51e2fb20c197343aaf2d602bad.dll

  • Size

    656KB

  • MD5

    103bce51e2fb20c197343aaf2d602bad

  • SHA1

    3df0dcccbce4abeb9639358e234e30055f569a7a

  • SHA256

    b95c5ad1c557db07298ed44764a8ba2b022c508ccef0f1a4ff87bf813e3e2463

  • SHA512

    31240770fd9725ba0d28450f245f28d4a1eb751067aa0252bb5c35e31ff9c8bdf406dbf2d2715d78fb8508fbfc3808a0f04ab59c195763e2b12b267ba924be6b

  • SSDEEP

    12288:cKYQ5LL540CV3UIeLPrleV1F0e8gMA/9L0l3HATpKR4:dYQ5p4f0POF0nkls3opKR

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\103bce51e2fb20c197343aaf2d602bad.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1728
  • C:\Windows\system32\consent.exe
    C:\Windows\system32\consent.exe
    1⤵
      PID:2600
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\VfEQkn.cmd
      1⤵
        PID:2148
      • C:\Windows\system32\SystemPropertiesHardware.exe
        C:\Windows\system32\SystemPropertiesHardware.exe
        1⤵
          PID:2816
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\abu.cmd
          1⤵
          • Drops file in System32 directory
          PID:2884
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /F /TN "Ajfbjcebwom" /TR "C:\Windows\system32\BAlLnB\SystemPropertiesHardware.exe" /SC minute /MO 60 /RL highest
          1⤵
          • Creates scheduled task(s)
          PID:2936
        • C:\Windows\system32\schtasks.exe
          C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
          1⤵
            PID:1852
          • C:\Windows\system32\schtasks.exe
            C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
            1⤵
              PID:1708
            • C:\Windows\system32\schtasks.exe
              C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
              1⤵
                PID:2748
              • C:\Windows\system32\schtasks.exe
                C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
                1⤵
                  PID:1164
                • C:\Windows\system32\schtasks.exe
                  C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
                  1⤵
                    PID:2536
                  • C:\Windows\system32\schtasks.exe
                    C:\Windows\system32\schtasks.exe /Query /TN "Ajfbjcebwom"
                    1⤵
                      PID:2192

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\HHX6356.tmp

                      Filesize

                      660KB

                      MD5

                      172640f7888fe44d8bb0601d72a06119

                      SHA1

                      cb34531771e3b91bca9d3b16cc4d692b3d2dc9a7

                      SHA256

                      efceacb585220dfe17d617218b28ddede99f21f2e6ee86e0cca68208a327742a

                      SHA512

                      22a432ed462a45aac70b322bc603d2ea34552a31f9a536d8148598a08a38ccf0b75c484cf6850d8bed4407ca9482e801284790726247c05b518b45cfc00e5d34

                    • C:\Users\Admin\AppData\Local\Temp\UTw3BC8.tmp

                      Filesize

                      664KB

                      MD5

                      db9b41311c937b2b6ff982bfebda0c5a

                      SHA1

                      32d3fb8ebf5148cf5eac6f9ff2c07cc1794b85de

                      SHA256

                      0564da405563b6b5f0c217d351451c391dc6e7bcbdc223a62a705d2da73f0526

                      SHA512

                      413c777bd2fd4dfdc1e06a70a91dd90f3650b9b86b0d33338695c2687c546b243191c8becd6ae3df943461f1a6ac2cd82c140780f9faaf8f4173aa4fbf082c87

                    • C:\Users\Admin\AppData\Local\Temp\VfEQkn.cmd

                      Filesize

                      234B

                      MD5

                      57128ccfeed83e637d38163ff3be92a4

                      SHA1

                      4270ff1c25d1786ce0d91bd608af8e2cdf4e32a0

                      SHA256

                      6b203be8a29335a9cead11e1387d4d863983baf35975a1e80463cb2bd11cef03

                      SHA512

                      fddefcc94911b890a0df1dabeb58fcb0f2f09e1a12612bbd9271d9fe4522a864b8feb22ce4457b9dfc2436049be834473af931a62e19e0cff006302eae0442cb

                    • C:\Users\Admin\AppData\Local\Temp\abu.cmd

                      Filesize

                      215B

                      MD5

                      72e1216c3e9ad375d4a89d780e90a6b4

                      SHA1

                      127dcf53e4f2e8a5d82c5ee26834ade103b2d023

                      SHA256

                      761bee2bef44a6e94777c583e0c938971396661e4729f3a07e8ccaf68267138d

                      SHA512

                      cc3b1cd8a56b7984a92c1cc95a1e4e8e9df21e880f1d16618dba478af29de48460491f82b7c3671f0e73db1d0aa6bfab5a5d00fd2a534e41fc8137b4fb619a0f

                    • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Bsfvntd.lnk

                      Filesize

                      798B

                      MD5

                      d6f72802e685797edf3b7781e00eb04b

                      SHA1

                      49ff7e5a7b2c231147044f0610a28be6729a1fb2

                      SHA256

                      ff8646dc1bff42ed47093b60fc43252e4edbc7cc00a3bc8911e8d164f0156a3f

                      SHA512

                      a4d3ca4ffa41c9e8ea5d717e341448b55906dcb668ca25ab10d04bdb17a197a7d09aac925c8c8203b10937805b27dd2c93e8bf1c53a0b3ec9c7f590b357a43ec

                    • C:\Users\Admin\AppData\Roaming\NdvH5hF\consent.exe

                      Filesize

                      109KB

                      MD5

                      0b5511674394666e9d221f8681b2c2e6

                      SHA1

                      6e4e720dfc424a12383f0b8194e4477e3bc346dc

                      SHA256

                      ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

                      SHA512

                      00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

                    • memory/1200-18-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-14-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-43-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-48-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-33-0x0000000077CE1000-0x0000000077CE2000-memory.dmp

                      Filesize

                      4KB

                    • memory/1200-32-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-25-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-24-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-22-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-21-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-20-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-19-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-3-0x0000000077AD6000-0x0000000077AD7000-memory.dmp

                      Filesize

                      4KB

                    • memory/1200-17-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-15-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-34-0x0000000077E40000-0x0000000077E42000-memory.dmp

                      Filesize

                      8KB

                    • memory/1200-13-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-12-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-11-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-10-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-9-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-8-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-4-0x00000000024F0000-0x00000000024F1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1200-6-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-31-0x00000000024D0000-0x00000000024D7000-memory.dmp

                      Filesize

                      28KB

                    • memory/1200-23-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1200-60-0x0000000077AD6000-0x0000000077AD7000-memory.dmp

                      Filesize

                      4KB

                    • memory/1200-16-0x0000000140000000-0x00000001400A4000-memory.dmp

                      Filesize

                      656KB

                    • memory/1728-7-0x000007FEF7AD0000-0x000007FEF7B74000-memory.dmp

                      Filesize

                      656KB

                    • memory/1728-1-0x0000000000390000-0x0000000000397000-memory.dmp

                      Filesize

                      28KB

                    • memory/1728-0-0x000007FEF7AD0000-0x000007FEF7B74000-memory.dmp

                      Filesize

                      656KB