Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 09:01

General

  • Target

    61f2627485987b4054ff97050f0dfe2b.dll

  • Size

    964KB

  • MD5

    61f2627485987b4054ff97050f0dfe2b

  • SHA1

    8ba24c683a74e29248653e465d46c5b244adb246

  • SHA256

    771e168408b17e5f7ae16bd3a878820d0e0a844f25d549507b6d2b9c8ed0c9e2

  • SHA512

    4caa9fd59cc8a9cca7edf9e9174ecde4b6cd5c235ab0d141c9ed7c933850526a3c6a443c5fee0a505154d47780badab326da15a86f65b49758c671ac292c1e0c

  • SSDEEP

    12288:3tCtvNv+h26xiWZu8xDPtgPuSYAuXIPY2wKg7oGviTVp7OC0aO1/ixB:3tChNv+ceiWjDVgyAurCg7osJ1

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 11 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\61f2627485987b4054ff97050f0dfe2b.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:5024
  • C:\Windows\system32\dpapimig.exe
    C:\Windows\system32\dpapimig.exe
    1⤵
      PID:4356
    • C:\Users\Admin\AppData\Local\ehB\dpapimig.exe
      C:\Users\Admin\AppData\Local\ehB\dpapimig.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3248
    • C:\Users\Admin\AppData\Local\cY4\Utilman.exe
      C:\Users\Admin\AppData\Local\cY4\Utilman.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1704
    • C:\Windows\system32\Utilman.exe
      C:\Windows\system32\Utilman.exe
      1⤵
        PID:1368
      • C:\Users\Admin\AppData\Local\AygmKefh\Netplwiz.exe
        C:\Users\Admin\AppData\Local\AygmKefh\Netplwiz.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3360
      • C:\Windows\system32\Netplwiz.exe
        C:\Windows\system32\Netplwiz.exe
        1⤵
          PID:4268
        • C:\Windows\system32\BackgroundTransferHost.exe
          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          1⤵
            PID:4268

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GaM\DUI70.dll

            Filesize

            65KB

            MD5

            603bedca38c1e59c5a49117bbe725e3c

            SHA1

            4274698f08110944de9859a2329dfafd32f4c211

            SHA256

            6f01557d006b423f898b40b0845787e3aacf04d56adedeb01d5a9d9428fca0da

            SHA512

            8845cabe5eab951c7426b74b48f83d9dff8eeb47399b012231aa1c8a0541749f42cc6066aa1eb679f8da6e22a9b242b6d58682c92dca41716bc8ecf347230682

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\uS\NETPLWIZ.dll

            Filesize

            968KB

            MD5

            f37e4c44fa9ef56cf5166248d227f17e

            SHA1

            84ad32cc6b7e61d35321e8bdb45a47abc2266fc7

            SHA256

            d0a58ce0c8bcfe06b35e1bd56e075f48caee1ef8423dc47f07b8c95953fa11b4

            SHA512

            7606328375df617355429fdbe6f90952dc27397899df051b4fd224072ac260bff82575c763ff0dfebfb984b5c04b1ee0a794e9becf9b40c0e621db369e817d8c

          • C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\YCW4X\OLEACC.dll

            Filesize

            512KB

            MD5

            fc91963f9914095408400cbf68c7e63c

            SHA1

            ff4ee0a0e39adf602ccd607ead80381ecbc28c62

            SHA256

            d68dd9b61cdf6ff4f541556eb151bf6fb5a90c1661723fe6687508ba808677dd

            SHA512

            156b011224dd568834a48ff728d1beed53781dad993bc4e57cd08fde36e54309603f13aab930849a965d1698401a89e3c5a686fc9729045d6990b778d5108a08

          • memory/1704-60-0x00007FFD58B80000-0x00007FFD58C72000-memory.dmp

            Filesize

            968KB

          • memory/1704-64-0x00007FFD58B80000-0x00007FFD58C72000-memory.dmp

            Filesize

            968KB

          • memory/1704-59-0x0000023FBCB60000-0x0000023FBCB67000-memory.dmp

            Filesize

            28KB

          • memory/3248-48-0x00007FFD58BE0000-0x00007FFD58D17000-memory.dmp

            Filesize

            1.2MB

          • memory/3248-43-0x00007FFD58BE0000-0x00007FFD58D17000-memory.dmp

            Filesize

            1.2MB

          • memory/3248-45-0x000001BE5CB80000-0x000001BE5CB87000-memory.dmp

            Filesize

            28KB

          • memory/3360-77-0x0000021BFCA10000-0x0000021BFCA17000-memory.dmp

            Filesize

            28KB

          • memory/3360-80-0x00007FFD58C20000-0x00007FFD58D12000-memory.dmp

            Filesize

            968KB

          • memory/3360-75-0x00007FFD58C20000-0x00007FFD58D12000-memory.dmp

            Filesize

            968KB

          • memory/3500-22-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-12-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-7-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-6-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-5-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-3-0x0000000002F70000-0x0000000002F71000-memory.dmp

            Filesize

            4KB

          • memory/3500-11-0x00007FFD765DA000-0x00007FFD765DB000-memory.dmp

            Filesize

            4KB

          • memory/3500-8-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-10-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-9-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-13-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-14-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-19-0x0000000000B70000-0x0000000000B77000-memory.dmp

            Filesize

            28KB

          • memory/3500-23-0x00007FFD76F60000-0x00007FFD76F70000-memory.dmp

            Filesize

            64KB

          • memory/3500-33-0x0000000140000000-0x00000001400F1000-memory.dmp

            Filesize

            964KB

          • memory/3500-24-0x00007FFD76F50000-0x00007FFD76F60000-memory.dmp

            Filesize

            64KB

          • memory/5024-0-0x00007FFD67970000-0x00007FFD67A61000-memory.dmp

            Filesize

            964KB

          • memory/5024-36-0x00007FFD67970000-0x00007FFD67A61000-memory.dmp

            Filesize

            964KB

          • memory/5024-1-0x000001B5B5C90000-0x000001B5B5C97000-memory.dmp

            Filesize

            28KB