Analysis

  • max time kernel
    175s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 14:04

General

  • Target

    2419b291711b308d6179fc8b0f354260.dll

  • Size

    1.3MB

  • MD5

    2419b291711b308d6179fc8b0f354260

  • SHA1

    d0a1b025a83a51d6a55f4bfc6f1920053bb40d81

  • SHA256

    b01ea30dce81bda2d39cd626a731e698910e9e51576dce55487d5df791fe8f94

  • SHA512

    158640e0e3ba1a7a0e2e70ced3f56b20dd1743cbb29f64e55ba3e0ce72e5168900180534e7e4fd8b7988f2150e755b561b2d946c84a908beb089d37b33bc0083

  • SSDEEP

    12288:fXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:vB/Qn0rbD8UZUDtgIiemI51Mwtewkm

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 11 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1684
  • C:\Windows\system32\SystemPropertiesHardware.exe
    C:\Windows\system32\SystemPropertiesHardware.exe
    1⤵
      PID:808
    • C:\Users\Admin\AppData\Local\dSczJEr\SystemPropertiesHardware.exe
      C:\Users\Admin\AppData\Local\dSczJEr\SystemPropertiesHardware.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1664
    • C:\Users\Admin\AppData\Local\axcv3\RdpSa.exe
      C:\Users\Admin\AppData\Local\axcv3\RdpSa.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3208
    • C:\Windows\system32\RdpSa.exe
      C:\Windows\system32\RdpSa.exe
      1⤵
        PID:2944
      • C:\Users\Admin\AppData\Local\BgZukU7U\recdisc.exe
        C:\Users\Admin\AppData\Local\BgZukU7U\recdisc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3776
      • C:\Windows\system32\recdisc.exe
        C:\Windows\system32\recdisc.exe
        1⤵
          PID:1412

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\dSczJEr\SystemPropertiesHardware.exe

          Filesize

          82KB

          MD5

          bf5bc0d70a936890d38d2510ee07a2cd

          SHA1

          69d5971fd264d8128f5633db9003afef5fad8f10

          SHA256

          c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7

          SHA512

          0e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\OSS\WINSTA.dll

          Filesize

          99KB

          MD5

          fd849056744b51d2b6892f1eb09dd40a

          SHA1

          657889d07014f091ba852a297b618ac794e2267d

          SHA256

          73c5ca075996825efd8e6854e30ecb6089c78feed1d023c1bce227582a2e99c2

          SHA512

          a41dc4b5635ba6ace4a5c4e67dd59a374c68b17d3d07f90d6a29204c0db976be8079c61f487bdf2fed644d1d0734252118d52f79b6a865157e5dc12accc1cc2c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ihcEjQzbi\SYSDM.CPL

          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • memory/1664-54-0x00007FFBE5A00000-0x00007FFBE5B4A000-memory.dmp

          Filesize

          1.3MB

        • memory/1664-49-0x00000190E9730000-0x00000190E9737000-memory.dmp

          Filesize

          28KB

        • memory/1664-50-0x00007FFBE5A00000-0x00007FFBE5B4A000-memory.dmp

          Filesize

          1.3MB

        • memory/1684-42-0x00007FFBF53D0000-0x00007FFBF5519000-memory.dmp

          Filesize

          1.3MB

        • memory/1684-0-0x0000024225F60000-0x0000024225F67000-memory.dmp

          Filesize

          28KB

        • memory/1684-1-0x00007FFBF53D0000-0x00007FFBF5519000-memory.dmp

          Filesize

          1.3MB

        • memory/3208-65-0x00007FFBE5C50000-0x00007FFBE5D9B000-memory.dmp

          Filesize

          1.3MB

        • memory/3208-70-0x00007FFBE5C50000-0x00007FFBE5D9B000-memory.dmp

          Filesize

          1.3MB

        • memory/3208-67-0x0000020F108D0000-0x0000020F108D7000-memory.dmp

          Filesize

          28KB

        • memory/3512-21-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-18-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-13-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-14-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-12-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-10-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-9-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-8-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-30-0x00007FFC03AB0000-0x00007FFC03AC0000-memory.dmp

          Filesize

          64KB

        • memory/3512-29-0x00007FFC03AC0000-0x00007FFC03AD0000-memory.dmp

          Filesize

          64KB

        • memory/3512-28-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-39-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-17-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-16-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-19-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-20-0x0000000000CA0000-0x0000000000CA7000-memory.dmp

          Filesize

          28KB

        • memory/3512-15-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-11-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-5-0x00007FFC03A2A000-0x00007FFC03A2B000-memory.dmp

          Filesize

          4KB

        • memory/3512-7-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3512-3-0x0000000002510000-0x0000000002511000-memory.dmp

          Filesize

          4KB

        • memory/3512-6-0x0000000140000000-0x0000000140149000-memory.dmp

          Filesize

          1.3MB

        • memory/3776-82-0x00007FFBE5AF0000-0x00007FFBE5C3A000-memory.dmp

          Filesize

          1.3MB

        • memory/3776-86-0x00007FFBE5AF0000-0x00007FFBE5C3A000-memory.dmp

          Filesize

          1.3MB

        • memory/3776-81-0x00000239AC030000-0x00000239AC037000-memory.dmp

          Filesize

          28KB