Analysis

  • max time kernel
    3s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 09:01

General

  • Target

    61f2627485987b4054ff97050f0dfe2b.dll

  • Size

    964KB

  • MD5

    61f2627485987b4054ff97050f0dfe2b

  • SHA1

    8ba24c683a74e29248653e465d46c5b244adb246

  • SHA256

    771e168408b17e5f7ae16bd3a878820d0e0a844f25d549507b6d2b9c8ed0c9e2

  • SHA512

    4caa9fd59cc8a9cca7edf9e9174ecde4b6cd5c235ab0d141c9ed7c933850526a3c6a443c5fee0a505154d47780badab326da15a86f65b49758c671ac292c1e0c

  • SSDEEP

    12288:3tCtvNv+h26xiWZu8xDPtgPuSYAuXIPY2wKg7oGviTVp7OC0aO1/ixB:3tChNv+ceiWjDVgyAurCg7osJ1

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 11 IoCs

    Detects Dridex x64 core DLL in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\61f2627485987b4054ff97050f0dfe2b.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1880
  • C:\Users\Admin\AppData\Local\v30v\SystemPropertiesHardware.exe
    C:\Users\Admin\AppData\Local\v30v\SystemPropertiesHardware.exe
    1⤵
      PID:1236
    • C:\Windows\system32\SystemPropertiesHardware.exe
      C:\Windows\system32\SystemPropertiesHardware.exe
      1⤵
        PID:2704
      • C:\Users\Admin\AppData\Local\DeV6irs\osk.exe
        C:\Users\Admin\AppData\Local\DeV6irs\osk.exe
        1⤵
          PID:2512
        • C:\Windows\system32\osk.exe
          C:\Windows\system32\osk.exe
          1⤵
            PID:2768
          • C:\Users\Admin\AppData\Local\nEke\notepad.exe
            C:\Users\Admin\AppData\Local\nEke\notepad.exe
            1⤵
              PID:2844
            • C:\Windows\system32\notepad.exe
              C:\Windows\system32\notepad.exe
              1⤵
                PID:2832

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1220-9-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-15-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-57-0x0000000076DB6000-0x0000000076DB7000-memory.dmp

                Filesize

                4KB

              • memory/1220-12-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-8-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-24-0x0000000077150000-0x0000000077152000-memory.dmp

                Filesize

                8KB

              • memory/1220-23-0x0000000077120000-0x0000000077122000-memory.dmp

                Filesize

                8KB

              • memory/1220-34-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-33-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-22-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-14-0x0000000002E60000-0x0000000002E67000-memory.dmp

                Filesize

                28KB

              • memory/1220-7-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-11-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-10-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-3-0x0000000076DB6000-0x0000000076DB7000-memory.dmp

                Filesize

                4KB

              • memory/1220-4-0x0000000002E80000-0x0000000002E81000-memory.dmp

                Filesize

                4KB

              • memory/1220-13-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1220-6-0x0000000140000000-0x00000001400F1000-memory.dmp

                Filesize

                964KB

              • memory/1236-50-0x000007FEF6EA0000-0x000007FEF6F92000-memory.dmp

                Filesize

                968KB

              • memory/1236-54-0x000007FEF6EA0000-0x000007FEF6F92000-memory.dmp

                Filesize

                968KB

              • memory/1236-52-0x0000000000090000-0x0000000000097000-memory.dmp

                Filesize

                28KB

              • memory/1880-2-0x00000000000A0000-0x00000000000A7000-memory.dmp

                Filesize

                28KB

              • memory/1880-42-0x000007FEF61E0000-0x000007FEF62D1000-memory.dmp

                Filesize

                964KB

              • memory/1880-0-0x000007FEF61E0000-0x000007FEF62D1000-memory.dmp

                Filesize

                964KB

              • memory/2512-71-0x000007FEF61E0000-0x000007FEF62D2000-memory.dmp

                Filesize

                968KB

              • memory/2512-69-0x0000000000110000-0x0000000000117000-memory.dmp

                Filesize

                28KB

              • memory/2512-67-0x000007FEF61E0000-0x000007FEF62D2000-memory.dmp

                Filesize

                968KB

              • memory/2844-184-0x000007FEF61E0000-0x000007FEF62D2000-memory.dmp

                Filesize

                968KB

              • memory/2844-181-0x0000000000100000-0x0000000000107000-memory.dmp

                Filesize

                28KB