Analysis

  • max time kernel
    133s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 16:57

General

  • Target

    7e7645b86e265b69aed08c4852fe6291.dll

  • Size

    1.1MB

  • MD5

    7e7645b86e265b69aed08c4852fe6291

  • SHA1

    0e39986ca509db0826c81ca3693fecb375726dcb

  • SHA256

    e0980b4994c3d61ec8c3ab1db13ef837487bd2e209e97a4ad4708211d9d4d712

  • SHA512

    2f2f7e96591bf49bec9e3b56f7457ee00ca85bd7812c6de3a27097fdfda3beb9b42467b7e0f11b01036704c635e461bbf3a2f12877f672a7de1af462611b26ff

  • SSDEEP

    12288:JkbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/RUX/ShJ:JkbHkWfzZ5adwLNGeStHntqN7vaP

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 9 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e7645b86e265b69aed08c4852fe6291.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3292
  • C:\Users\Admin\AppData\Local\ePXXSj8w\wbengine.exe
    C:\Users\Admin\AppData\Local\ePXXSj8w\wbengine.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:3500
  • C:\Windows\system32\wbengine.exe
    C:\Windows\system32\wbengine.exe
    1⤵
      PID:4032
    • C:\Users\Admin\AppData\Local\rN1c7\rdpclip.exe
      C:\Users\Admin\AppData\Local\rN1c7\rdpclip.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4040
    • C:\Windows\system32\rdpclip.exe
      C:\Windows\system32\rdpclip.exe
      1⤵
        PID:4952
      • C:\Users\Admin\AppData\Local\151\cmstp.exe
        C:\Users\Admin\AppData\Local\151\cmstp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4276
      • C:\Windows\system32\cmstp.exe
        C:\Windows\system32\cmstp.exe
        1⤵
          PID:4748

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Proof\59w7Pw\WTSAPI32.dll

          Filesize

          391KB

          MD5

          df592eea3fa83e64d1d1685224242d52

          SHA1

          f6dfd7883bba096273d91ae6dac6bea43a9fde9a

          SHA256

          297293d8c707ceb3c2fd63c10e596b18705ab849660ec228eeed3b78a1cd0a68

          SHA512

          f07a198d267b488a01d214b76b6808cec80748c6dd0824684f6161e1ad50e6ab15d479b00f235467708e06a7ea4cb008fa1691a86867f88a8dd4e257287d0625

        • C:\Users\Admin\AppData\Roaming\Microsoft\Proof\kbISvKG\XmlLite.dll

          Filesize

          348KB

          MD5

          d465079a62622c3894e644d3b59e31c8

          SHA1

          58842196b79d9e1299e310e94a803bf245898cbe

          SHA256

          6aead4e3b6d7bf7000ed3d462d6f18507b4302806dc1c738ebd7c13c5519a146

          SHA512

          d61c3e4a5ba06e02db09c1941eb6b1df7c9243a8528a2a4792f1532d1c4ca4e3481524b1ad702638a2d92450597045697744b7a7f8f250fb1836969a192af4c3

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\E8PdapiDMJq\VERSION.dll

          Filesize

          96KB

          MD5

          957d8ffe1faf0fdddd6a06957860c3a3

          SHA1

          fa21e34011676c63a3f6f44937cddc080d6261bb

          SHA256

          45e34220c7919c825c15ef45645cf4aac140cb7461fd72b80850e07b9f9a0cc3

          SHA512

          e6947c861abcf6c63f452fc348246ba553612aa93c80e4346a79a2687f104c6a5657b2dab58d007634ec11e4cdb6e0ea06dc780fa011b0de498df1b0ca3cb426

        • memory/3292-0-0x00007FF987870000-0x00007FF987989000-memory.dmp

          Filesize

          1.1MB

        • memory/3292-2-0x000002F0A10B0000-0x000002F0A10B7000-memory.dmp

          Filesize

          28KB

        • memory/3292-41-0x00007FF987870000-0x00007FF987989000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-11-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-7-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-27-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-19-0x0000000000AF0000-0x0000000000AF7000-memory.dmp

          Filesize

          28KB

        • memory/3448-17-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-16-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-15-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-14-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-13-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-12-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-38-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-10-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-9-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-28-0x00007FF992A60000-0x00007FF992A70000-memory.dmp

          Filesize

          64KB

        • memory/3448-6-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-5-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-3-0x00000000029A0000-0x00000000029A1000-memory.dmp

          Filesize

          4KB

        • memory/3448-29-0x00007FF992A50000-0x00007FF992A60000-memory.dmp

          Filesize

          64KB

        • memory/3448-8-0x00007FF9912EA000-0x00007FF9912EB000-memory.dmp

          Filesize

          4KB

        • memory/3448-18-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3448-20-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/3500-50-0x000002C097C90000-0x000002C097C97000-memory.dmp

          Filesize

          28KB

        • memory/3500-53-0x00007FF974930000-0x00007FF974A4A000-memory.dmp

          Filesize

          1.1MB

        • memory/3500-48-0x00007FF974930000-0x00007FF974A4A000-memory.dmp

          Filesize

          1.1MB

        • memory/4040-69-0x00007FF974930000-0x00007FF974A4A000-memory.dmp

          Filesize

          1.1MB

        • memory/4040-66-0x0000025D17CD0000-0x0000025D17CD7000-memory.dmp

          Filesize

          28KB

        • memory/4276-83-0x0000025600330000-0x0000025600337000-memory.dmp

          Filesize

          28KB

        • memory/4276-86-0x00007FF974930000-0x00007FF974A4A000-memory.dmp

          Filesize

          1.1MB