Analysis

  • max time kernel
    142s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 19:44

General

  • Target

    38f8f403c494cd304763615d922a67fb.dll

  • Size

    848KB

  • MD5

    38f8f403c494cd304763615d922a67fb

  • SHA1

    7706587dd4bc348037452e7833c6cd663111f440

  • SHA256

    60df94d0fa102fe714906ec53efafa0308a79d6caf9e8688edc8525123a7b1e3

  • SHA512

    8426cb54939bf66bcda1c537ecd0c574d64e548cbf04e03a38f15c670db0300c856a0ea5876b4c551edcdac8d33b266c6dc8f5f00944ffb1bc6fb796537679f8

  • SSDEEP

    12288:AkbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/R:AkbHkWfzZ5adwLNGeStHntqN7v

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 12 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\38f8f403c494cd304763615d922a67fb.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2992
  • C:\Users\Admin\AppData\Local\7oKdN\wusa.exe
    C:\Users\Admin\AppData\Local\7oKdN\wusa.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1780
  • C:\Windows\system32\wusa.exe
    C:\Windows\system32\wusa.exe
    1⤵
      PID:2636
    • C:\Windows\system32\irftp.exe
      C:\Windows\system32\irftp.exe
      1⤵
        PID:2284
      • C:\Users\Admin\AppData\Local\w6tj4DYpk\irftp.exe
        C:\Users\Admin\AppData\Local\w6tj4DYpk\irftp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1980
      • C:\Users\Admin\AppData\Local\o003sK3rh\wisptis.exe
        C:\Users\Admin\AppData\Local\o003sK3rh\wisptis.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:960
      • C:\Windows\system32\wisptis.exe
        C:\Windows\system32\wisptis.exe
        1⤵
          PID:2200

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\7oKdN\wusa.exe

          Filesize

          300KB

          MD5

          c15b3d813f4382ade98f1892350f21c7

          SHA1

          a45c5abc6751bc8b9041e5e07923fa4fc1b4542b

          SHA256

          8f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3

          SHA512

          6d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c

        • C:\Users\Admin\AppData\Local\o003sK3rh\wisptis.exe

          Filesize

          64KB

          MD5

          d3bfe2cdc51a5dcb521f13789a5afab6

          SHA1

          658979a43cd87918e7b44b264d559e35638cd38a

          SHA256

          f42b797ddf5cf69b85a5fc11c7d3a054c39378bfe41f8398370def0ee91907bb

          SHA512

          3b4526a60fe24043ccd6645587ed2e80adf85e8585c8ab5112a18a1914fce5e0cdf2cf30ea0b87f24eae08802278b0371eb54d39bda101d93c299d0f94eb6ac9

        • C:\Users\Admin\AppData\Local\w6tj4DYpk\irftp.exe

          Filesize

          192KB

          MD5

          0cae1fb725c56d260bfd6feba7ae9a75

          SHA1

          102ac676a1de3ec3d56401f8efd518c31c8b0b80

          SHA256

          312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

          SHA512

          db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

        • C:\Users\Admin\AppData\Local\w6tj4DYpk\irftp.exe

          Filesize

          92KB

          MD5

          9e533dfa44971dd83d8b41872ce85aa7

          SHA1

          a9a2e75303b64639ea29ed479cd4c9ab08a74614

          SHA256

          1549c27b806996a0bb0ee2dc2ea793d9b080f47c47d5f1e8a6b66548b214a46f

          SHA512

          1e19ff23efb06d02bcaf97a5999942365d1399f8d433c9743a4658af51157fae4c4d0abcfd4625c34df4f8c98a46e2b1d4f9ab73de8a19e6520a1ffd263b6fd1

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dbyxyty.lnk

          Filesize

          1KB

          MD5

          18d942ddafc8649cc693b08f60cd624f

          SHA1

          57c8c65c1c29af9cb4decc7e49748d07afe5cfe0

          SHA256

          5bc2ab6b99d23447c1c627424f5fd62fb3eac661d08db99cce59860721d232bd

          SHA512

          9dedad08c2235bc2aba6e33c687baa0764587377729cb3a34b9f2d136362d4c7b7e57fde8659f054d1479e4730ed420c18bddf2fcc7a9edefc6a5be83a70fd71

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HBEqyAV58vO\OLEACC.dll

          Filesize

          204KB

          MD5

          e3068892fb3a7dbca335b9d80fef74bc

          SHA1

          79c16222b4ee3f3293c2f8458858953008cff8d3

          SHA256

          e387fcb89cf3ea1aa3480f6c9c7fd7fd8b5b21b3b92a2c33fad8b69f6fbd7399

          SHA512

          4ff3d136ea31550a93efc379942dd163210c4dab4ddea0eebc9b7d6b4c3a198a505d019525a57dab21ae257e7a68e3954307937bd6646f30cd911e0d9ecfd578

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HBEqyAV58vO\wisptis.exe

          Filesize

          93KB

          MD5

          e105c5ff1c41341c6cfc983dfa2d3b85

          SHA1

          395c5490edd03084518326c48d693467384365a2

          SHA256

          ddff5dc9314ef3520a7b6249265d3aa38dc7450a19715ab416d6a93d853a6e1f

          SHA512

          cc6dd71fcc60edc5573e82dc088a96e6442cf742766005e2677dbf9e144bb5ced15920bbd29acb9ad7d74ffa377ed954ce2736a516c0ca0a83b9dee5295f5d87

        • \Users\Admin\AppData\Local\7oKdN\WTSAPI32.dll

          Filesize

          852KB

          MD5

          6b8215702b2b611702961429f547f1b0

          SHA1

          ebac71e0f0a3f6eb64e96589a1637721b5281d73

          SHA256

          a5a38bfc8e0cd0c149b6085f58e31bf3ba370940312f32fef389ae4d397d0812

          SHA512

          efb28c94c36d42a792f962de89ab20d71dd81f5f2b6e930d1e38f73d019cc85eec37714da02d3b0e8e5f0739e9fd90707c9d3a01ddd9219832ff4785675162f3

        • \Users\Admin\AppData\Local\o003sK3rh\OLEACC.dll

          Filesize

          92KB

          MD5

          4081bb4b625db5ef7d7b382cf3382dc1

          SHA1

          56c5d23dedd55e02e0f40165f01d41e3bf252703

          SHA256

          5eb7adaca9d4c400ecd61afdf1315b4389a788b73b992b6b9b5b191729d2c6a4

          SHA512

          a6d32ebaeee27fe5b21f85d89b386392ac91a8cf723b6822a444446cb4028a8be6a2604416648f498c0d166a60918f1c2953b743928fbe66433d596cd9ee372d

        • \Users\Admin\AppData\Local\o003sK3rh\wisptis.exe

          Filesize

          65KB

          MD5

          7b21b17231a5b82ddfdef670ae0bfdac

          SHA1

          ca3a23edddb340adba0b0c86108a9a5eb11c5aeb

          SHA256

          f8c886145f5f254286eae9e829efbe0ce1bfcf27fcc0fcf802d19001a128c13e

          SHA512

          0ad7c7ce50cce630ffbeeff44fef4f53d25ba4df0cd8a073b7d68c8f1203617c37a4b4f3307b5bdf16104fb02cb90121af68713ea92f9696732def06ddc3bfce

        • \Users\Admin\AppData\Local\w6tj4DYpk\MFC42u.dll

          Filesize

          876KB

          MD5

          21c04396d9700c641f6b4d10d437d0ac

          SHA1

          aeb6bed31e5b9cefad233b9f866953cbb533566e

          SHA256

          0a30274f4042c5e5179f1bd4f6b34d6da3cc048101a3b21634a9d7184e846492

          SHA512

          3d03767a555885b920887e267d2f8ee60bf8ab9da5d79b6bfae1798425af366dd78ee4ff83b8f9e3e1ec8a16f005a355c8ac0e81c8542ea85ed506da298e4acf

        • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HBEqyAV58vO\wisptis.exe

          Filesize

          92KB

          MD5

          0034faf01b54f76acc34ccb8c467ca45

          SHA1

          09d48ea6405d3da85cda38090d7e73a1d6efab9e

          SHA256

          811da14b086003b32b1e58407b6c03d9e527837ee87e45c93b11d30f51ac19d3

          SHA512

          090a432374bc0d765da6aed8c1e5dad42e6875f7d0e577a2e3059bb07550ed3be4d6b0cab304771895e2f346d2f1351d9f647f9e63222b8946c8eb87cbba3282

        • memory/960-91-0x000007FEF6DF0000-0x000007FEF6EC5000-memory.dmp

          Filesize

          852KB

        • memory/960-93-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/960-94-0x000007FEF6DF0000-0x000007FEF6EC5000-memory.dmp

          Filesize

          852KB

        • memory/1380-38-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-65-0x0000000077AE6000-0x0000000077AE7000-memory.dmp

          Filesize

          4KB

        • memory/1380-9-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-8-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-7-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-6-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-4-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

          Filesize

          4KB

        • memory/1380-3-0x0000000077AE6000-0x0000000077AE7000-memory.dmp

          Filesize

          4KB

        • memory/1380-40-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-17-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-11-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-26-0x0000000002E80000-0x0000000002E87000-memory.dmp

          Filesize

          28KB

        • memory/1380-29-0x0000000077E80000-0x0000000077E82000-memory.dmp

          Filesize

          8KB

        • memory/1380-28-0x0000000077E50000-0x0000000077E52000-memory.dmp

          Filesize

          8KB

        • memory/1380-12-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-10-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-27-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-19-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-18-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-13-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-14-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-15-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1380-16-0x0000000140000000-0x00000001400D4000-memory.dmp

          Filesize

          848KB

        • memory/1780-55-0x000007FEF73D0000-0x000007FEF74A5000-memory.dmp

          Filesize

          852KB

        • memory/1780-57-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/1780-59-0x000007FEF73D0000-0x000007FEF74A5000-memory.dmp

          Filesize

          852KB

        • memory/1980-75-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/1980-77-0x000007FEF6DF0000-0x000007FEF6ECB000-memory.dmp

          Filesize

          876KB

        • memory/1980-73-0x000007FEF6DF0000-0x000007FEF6ECB000-memory.dmp

          Filesize

          876KB

        • memory/2992-41-0x000007FEF73D0000-0x000007FEF74A4000-memory.dmp

          Filesize

          848KB

        • memory/2992-1-0x00000000002A0000-0x00000000002A7000-memory.dmp

          Filesize

          28KB

        • memory/2992-0-0x000007FEF73D0000-0x000007FEF74A4000-memory.dmp

          Filesize

          848KB