Analysis

  • max time kernel
    12s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 16:57

General

  • Target

    7e7645b86e265b69aed08c4852fe6291.dll

  • Size

    1.1MB

  • MD5

    7e7645b86e265b69aed08c4852fe6291

  • SHA1

    0e39986ca509db0826c81ca3693fecb375726dcb

  • SHA256

    e0980b4994c3d61ec8c3ab1db13ef837487bd2e209e97a4ad4708211d9d4d712

  • SHA512

    2f2f7e96591bf49bec9e3b56f7457ee00ca85bd7812c6de3a27097fdfda3beb9b42467b7e0f11b01036704c635e461bbf3a2f12877f672a7de1af462611b26ff

  • SSDEEP

    12288:JkbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/RUX/ShJ:JkbHkWfzZ5adwLNGeStHntqN7vaP

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 6 IoCs

    Detects Dridex x64 core DLL in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e7645b86e265b69aed08c4852fe6291.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3064
  • C:\Windows\system32\slui.exe
    C:\Windows\system32\slui.exe
    1⤵
      PID:1904
    • C:\Users\Admin\AppData\Local\T8dJPz2\slui.exe
      C:\Users\Admin\AppData\Local\T8dJPz2\slui.exe
      1⤵
        PID:2912
      • C:\Users\Admin\AppData\Local\yoADsHxAC\wisptis.exe
        C:\Users\Admin\AppData\Local\yoADsHxAC\wisptis.exe
        1⤵
          PID:1996
        • C:\Windows\system32\wisptis.exe
          C:\Windows\system32\wisptis.exe
          1⤵
            PID:1224
          • C:\Users\Admin\AppData\Local\Nc2VO\msdtc.exe
            C:\Users\Admin\AppData\Local\Nc2VO\msdtc.exe
            1⤵
              PID:1556
            • C:\Windows\system32\msdtc.exe
              C:\Windows\system32\msdtc.exe
              1⤵
                PID:1076
              • C:\Users\Admin\AppData\Local\nKRz0o\vmicsvc.exe
                C:\Users\Admin\AppData\Local\nKRz0o\vmicsvc.exe
                1⤵
                  PID:2272
                • C:\Windows\system32\vmicsvc.exe
                  C:\Windows\system32\vmicsvc.exe
                  1⤵
                    PID:2152

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1316-39-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-4-0x0000000002B40000-0x0000000002B41000-memory.dmp

                    Filesize

                    4KB

                  • memory/1316-3-0x0000000077306000-0x0000000077307000-memory.dmp

                    Filesize

                    4KB

                  • memory/1316-38-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-7-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-13-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-15-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-17-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-20-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-19-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-18-0x0000000002B20000-0x0000000002B27000-memory.dmp

                    Filesize

                    28KB

                  • memory/1316-27-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-29-0x00000000775A0000-0x00000000775A2000-memory.dmp

                    Filesize

                    8KB

                  • memory/1316-28-0x0000000077570000-0x0000000077572000-memory.dmp

                    Filesize

                    8KB

                  • memory/1316-16-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-14-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-53-0x0000000077306000-0x0000000077307000-memory.dmp

                    Filesize

                    4KB

                  • memory/1316-6-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-8-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-12-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-11-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-10-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1316-9-0x0000000140000000-0x0000000140119000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1556-80-0x000007FEF6030000-0x000007FEF614A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1556-83-0x000007FEF6030000-0x000007FEF614A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1556-79-0x00000000003E0000-0x00000000003E7000-memory.dmp

                    Filesize

                    28KB

                  • memory/1996-66-0x000007FEF6B40000-0x000007FEF6C5A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1996-69-0x000007FEF6B40000-0x000007FEF6C5A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1996-65-0x0000000000410000-0x0000000000417000-memory.dmp

                    Filesize

                    28KB

                  • memory/2272-192-0x0000000000070000-0x0000000000077000-memory.dmp

                    Filesize

                    28KB

                  • memory/2272-193-0x000007FEF6860000-0x000007FEF697A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/2272-196-0x000007FEF6860000-0x000007FEF697A000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3064-1-0x0000000000110000-0x0000000000117000-memory.dmp

                    Filesize

                    28KB

                  • memory/3064-47-0x000007FEF6030000-0x000007FEF6149000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3064-0-0x000007FEF6030000-0x000007FEF6149000-memory.dmp

                    Filesize

                    1.1MB