Analysis

  • max time kernel
    60s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 14:04

General

  • Target

    2419b291711b308d6179fc8b0f354260.dll

  • Size

    1.3MB

  • MD5

    2419b291711b308d6179fc8b0f354260

  • SHA1

    d0a1b025a83a51d6a55f4bfc6f1920053bb40d81

  • SHA256

    b01ea30dce81bda2d39cd626a731e698910e9e51576dce55487d5df791fe8f94

  • SHA512

    158640e0e3ba1a7a0e2e70ced3f56b20dd1743cbb29f64e55ba3e0ce72e5168900180534e7e4fd8b7988f2150e755b561b2d946c84a908beb089d37b33bc0083

  • SSDEEP

    12288:fXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:vB/Qn0rbD8UZUDtgIiemI51Mwtewkm

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 12 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2856
  • C:\Windows\system32\Utilman.exe
    C:\Windows\system32\Utilman.exe
    1⤵
      PID:2756
    • C:\Users\Admin\AppData\Local\FFM8\Utilman.exe
      C:\Users\Admin\AppData\Local\FFM8\Utilman.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      PID:2620
    • C:\Users\Admin\AppData\Local\etS\wusa.exe
      C:\Users\Admin\AppData\Local\etS\wusa.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2920
    • C:\Windows\system32\wusa.exe
      C:\Windows\system32\wusa.exe
      1⤵
        PID:3068
      • C:\Windows\system32\dpapimig.exe
        C:\Windows\system32\dpapimig.exe
        1⤵
          PID:300
        • C:\Users\Admin\AppData\Local\OT09Eq\dpapimig.exe
          C:\Users\Admin\AppData\Local\OT09Eq\dpapimig.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1720

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1212-13-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-18-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-3-0x0000000076C76000-0x0000000076C77000-memory.dmp

          Filesize

          4KB

        • memory/1212-12-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-20-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-11-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-29-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

          Filesize

          8KB

        • memory/1212-39-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-40-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-28-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-27-0x0000000002E20000-0x0000000002E27000-memory.dmp

          Filesize

          28KB

        • memory/1212-19-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-17-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-16-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-15-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-14-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-125-0x0000000076C76000-0x0000000076C77000-memory.dmp

          Filesize

          4KB

        • memory/1212-4-0x0000000002E10000-0x0000000002E11000-memory.dmp

          Filesize

          4KB

        • memory/1212-30-0x0000000076F10000-0x0000000076F12000-memory.dmp

          Filesize

          8KB

        • memory/1212-10-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-9-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-8-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-7-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1212-6-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/1720-283-0x000007FEF5830000-0x000007FEF59AD000-memory.dmp

          Filesize

          1.5MB

        • memory/1720-286-0x000007FEF5830000-0x000007FEF59AD000-memory.dmp

          Filesize

          1.5MB

        • memory/2620-60-0x000007FEF5960000-0x000007FEF5ADD000-memory.dmp

          Filesize

          1.5MB

        • memory/2620-58-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/2620-56-0x000007FEF5960000-0x000007FEF5ADD000-memory.dmp

          Filesize

          1.5MB

        • memory/2856-48-0x000007FEF5990000-0x000007FEF5AD9000-memory.dmp

          Filesize

          1.3MB

        • memory/2856-0-0x000007FEF5990000-0x000007FEF5AD9000-memory.dmp

          Filesize

          1.3MB

        • memory/2856-2-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2920-170-0x000007FEF5860000-0x000007FEF59AA000-memory.dmp

          Filesize

          1.3MB

        • memory/2920-174-0x000007FEF5860000-0x000007FEF59AA000-memory.dmp

          Filesize

          1.3MB

        • memory/2920-172-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB