Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 02:15

General

  • Target

    4c0c037a083e2b1f6b5fcb9c68263c5a.dll

  • Size

    852KB

  • MD5

    4c0c037a083e2b1f6b5fcb9c68263c5a

  • SHA1

    5b4abfb3aeaf1c1fa6658f6d8fc3b14c17bc931d

  • SHA256

    7c710407ba8ed2c0d2f970a81715d7982ddd44ad0838bfefdca8119350325bc4

  • SHA512

    6d1237fdc0187e7f2385a02e44d0e8ec4124b1bd1a340bf8c089bc79db8b212ad2b7831cd187ac15060a4aaed4e3587688cce508a11aeecc9b903ca94b838b3e

  • SSDEEP

    12288:4kbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/R:4kbHkWfzZ5adwLNGeStHntqN7v

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 7 IoCs

    Detects Dridex x64 core DLL in memory.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c0c037a083e2b1f6b5fcb9c68263c5a.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1520
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\system32\sethc.exe
      C:\Windows\system32\sethc.exe
      2⤵
        PID:1896
      • C:\Users\Admin\AppData\Local\wuyKxiO\sethc.exe
        C:\Users\Admin\AppData\Local\wuyKxiO\sethc.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2244
      • C:\Windows\system32\DWWIN.EXE
        C:\Windows\system32\DWWIN.EXE
        2⤵
          PID:2372
        • C:\Users\Admin\AppData\Local\WU2HYkr\DWWIN.EXE
          C:\Users\Admin\AppData\Local\WU2HYkr\DWWIN.EXE
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1360
        • C:\Windows\system32\Netplwiz.exe
          C:\Windows\system32\Netplwiz.exe
          2⤵
            PID:2368
          • C:\Users\Admin\AppData\Local\B2E\Netplwiz.exe
            C:\Users\Admin\AppData\Local\B2E\Netplwiz.exe
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:2288

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\B2E\NETPLWIZ.dll

          Filesize

          381KB

          MD5

          2921af0f67f1bf496a7b4c4e2358c305

          SHA1

          0ece311f9e726baca770772f8040dca935879b11

          SHA256

          0be4db4ad7e7e34f59babe397f08984b57d4d7d6f6ac1e3694059e6bcd44d457

          SHA512

          3c391a0102966b1b30207ba487125d36e779e712eb0fea0b79223899c731978b335ad0cb90398c73492e52ca3cdeadffa3a6a23613f80bdcdd9bcedaafadd039

        • C:\Users\Admin\AppData\Local\WU2HYkr\VERSION.dll

          Filesize

          856KB

          MD5

          44e477b53743a23fd57e22462b617b67

          SHA1

          d3063acf475515c84020619aeec6474719bb5a3c

          SHA256

          e7871b8464905bcd9de629bcda24eec14cb17f12b1b6413587787e5e15425f79

          SHA512

          9c98d63158dd796c1d95830920fd3e96ca99b66eaa318b73cb1c1af7163b562393861216366fd60603715f44b661be9656d267245daa3543a7c18471c300777c

        • C:\Users\Admin\AppData\Local\wuyKxiO\sethc.exe

          Filesize

          272KB

          MD5

          3bcb70da9b5a2011e01e35ed29a3f3f3

          SHA1

          9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

          SHA256

          dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

          SHA512

          69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Gmfoo.lnk

          Filesize

          1KB

          MD5

          40113533f6adef00575473f0669f8f60

          SHA1

          10d8cc9c1cb333555cc8a987fad94a2eacbba600

          SHA256

          da9cb7c743afe41e54bd143f99f367e9e480e0b600ef3ff7bd9758fe61082d85

          SHA512

          8be040fa4a0f108e111ba8aee2b15721f95961ce4c639045976166663ce96980f679b36825a4341e123ea14bc3d90571f838f528e4c83ab09c04441df718a379

        • C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\NlOVL\UxTheme.dll

          Filesize

          573KB

          MD5

          620429ff8eab888c419cf049a274fe5e

          SHA1

          33491a8fc87a6b36ce44f1f17f61331fd5c5a994

          SHA256

          0682794738f770371ef3b865b86a34fa608bebdce1f996cf2f6de86d258b0893

          SHA512

          f4b31f7710c5edf86b7510ed5500901355e306e5d23573e9355d23eeafa0655b16adf6882e835470d66982f14d5a6ba84887898ee0791181e8660f5f70dceabd

        • \Users\Admin\AppData\Local\B2E\NETPLWIZ.dll

          Filesize

          856KB

          MD5

          6d4bc6da4c5fb0eff6253c7d3facc473

          SHA1

          828e0e7f1e9c85d68893da182c6269c992f21b31

          SHA256

          e3dcbb8120c48c08bda90c7f24459a80502557562766096a3cc54ab3d43ce56d

          SHA512

          3f9156f4f0c2c6bb6ce7309aa1f488aef5d1b6b7ce1f7b2423b7f0f4ed466989203924009f43a39338a1282cbd5e53bd87b816bcd88c681af6b9214c7dd45e44

        • \Users\Admin\AppData\Local\B2E\Netplwiz.exe

          Filesize

          26KB

          MD5

          e43ec3c800d4c0716613392e81fba1d9

          SHA1

          37de6a235e978ecf3bb0fc2c864016c5b0134348

          SHA256

          636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c

          SHA512

          176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

        • \Users\Admin\AppData\Local\WU2HYkr\DWWIN.EXE

          Filesize

          149KB

          MD5

          25247e3c4e7a7a73baeea6c0008952b1

          SHA1

          8087adb7a71a696139ddc5c5abc1a84f817ab688

          SHA256

          c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050

          SHA512

          bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b

        • \Users\Admin\AppData\Local\wuyKxiO\UxTheme.dll

          Filesize

          856KB

          MD5

          0863db87b29922d15403a0939089f7e5

          SHA1

          25fd6c6743c7e2d40c137bcb31acf413ff5fbb02

          SHA256

          7eaf0f7056462d01a8a95cbe0da22db34d88a2250ca8f8aefff6e72f0ec3c32f

          SHA512

          3d4d8a6fb88b4057568ea688feb8ba70dae5ec8de193c1e9e3b148f5f955e6d457a6e6509013e44d6bea6e4f9dd7d2ed9df1a0344addfb72ffaa38840ef6065e

        • \Users\Admin\AppData\Local\wuyKxiO\sethc.exe

          Filesize

          99KB

          MD5

          526924c3f34218a419448b744fadcdea

          SHA1

          db8b185181de56c223e101e06cf521dcde4f99c9

          SHA256

          8dc1454e22bf71a457fee6b1ff2518bfde592e7c321276b4cedd89f97ef48f42

          SHA512

          a8361a18d5e491dbb520a878161eb4ca948a8a6690ee9fc1033dfd65b673a90cc578f5ea04910d76e740a37cf36c2520d343a2468fbf4c55807e7f4e07396966

        • memory/1360-103-0x0000000000160000-0x0000000000167000-memory.dmp

          Filesize

          28KB

        • memory/1368-18-0x0000000002760000-0x0000000002767000-memory.dmp

          Filesize

          28KB

        • memory/1368-15-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-11-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-10-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-9-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-8-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-7-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-4-0x0000000002780000-0x0000000002781000-memory.dmp

          Filesize

          4KB

        • memory/1368-3-0x00000000777B6000-0x00000000777B7000-memory.dmp

          Filesize

          4KB

        • memory/1368-28-0x0000000002740000-0x0000000002741000-memory.dmp

          Filesize

          4KB

        • memory/1368-14-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-13-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-16-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-6-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-19-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-20-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-17-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1368-12-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/1520-1-0x0000000000220000-0x0000000000227000-memory.dmp

          Filesize

          28KB

        • memory/1520-27-0x000007FEF6A50000-0x000007FEF6B25000-memory.dmp

          Filesize

          852KB

        • memory/1520-0-0x000007FEF6A50000-0x000007FEF6B25000-memory.dmp

          Filesize

          852KB

        • memory/2244-86-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/2244-85-0x000007FEF6A50000-0x000007FEF6B26000-memory.dmp

          Filesize

          856KB

        • memory/2288-120-0x0000000000070000-0x0000000000077000-memory.dmp

          Filesize

          28KB

        • memory/2896-57-0x0000000077B20000-0x0000000077B22000-memory.dmp

          Filesize

          8KB

        • memory/2896-95-0x0000000077750000-0x000000007786F000-memory.dmp

          Filesize

          1.1MB

        • memory/2896-69-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/2896-56-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/2896-67-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/2896-58-0x0000000077B50000-0x0000000077B52000-memory.dmp

          Filesize

          8KB

        • memory/2896-50-0x00000000047F0000-0x00000000047F7000-memory.dmp

          Filesize

          28KB

        • memory/2896-47-0x0000000140000000-0x00000001400D5000-memory.dmp

          Filesize

          852KB

        • memory/2896-84-0x0000000004260000-0x0000000004261000-memory.dmp

          Filesize

          4KB

        • memory/2896-32-0x0000000077750000-0x000000007786F000-memory.dmp

          Filesize

          1.1MB

        • memory/2896-30-0x0000000004260000-0x0000000004261000-memory.dmp

          Filesize

          4KB