Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-12-2023 05:07

General

  • Target

    c60920a9c292aa669035396b03965a08.dll

  • Size

    932KB

  • MD5

    c60920a9c292aa669035396b03965a08

  • SHA1

    c6005bcff4c1a3161bdc681b68ddadb2b771a5b6

  • SHA256

    4e37a17479c456a66c1b5bbc8204e65e2a7049852836df593d3cffad7ea546c9

  • SHA512

    e5b79d76ea45af823612782d5c1c6426084c6cfab908d5bb5db4134b24e9f91ee3bd291e1da2dbb9b3801483926b767b2ad1b9c35c02d7ab4177893d630a2797

  • SSDEEP

    12288:yPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK88:ytKTrsKSKBTSb6DUXWq88

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 10 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2524
  • C:\Windows\system32\rekeywiz.exe
    C:\Windows\system32\rekeywiz.exe
    1⤵
      PID:2592
    • C:\Users\Admin\AppData\Local\WzlF\rekeywiz.exe
      C:\Users\Admin\AppData\Local\WzlF\rekeywiz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2012
    • C:\Windows\system32\VaultSysUi.exe
      C:\Windows\system32\VaultSysUi.exe
      1⤵
        PID:1248
      • C:\Users\Admin\AppData\Local\oP1YJUqQY\VaultSysUi.exe
        C:\Users\Admin\AppData\Local\oP1YJUqQY\VaultSysUi.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1960
      • C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
        C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
        1⤵
          PID:584
        • C:\Users\Admin\AppData\Local\I0MBl\WindowsAnytimeUpgradeResults.exe
          C:\Users\Admin\AppData\Local\I0MBl\WindowsAnytimeUpgradeResults.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:776

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\I0MBl\DUI70.dll

          Filesize

          141KB

          MD5

          1e3ec73e63598d793ab266ee2d2adad5

          SHA1

          d8afb986665feda3970c567f28a724ef4f109334

          SHA256

          63cee2f180167899c14ab68dd83cbfa609933d2169ee3100164a24a1b48bd140

          SHA512

          2a06147c5e93c3817c8095ba82f42ebc2325cff1c58ed5c83e919a096f0d0456e5a3cb35b9b7bd775c437c866dc2c630e5436795d689469da3ef42054a99b52a

        • C:\Users\Admin\AppData\Local\I0MBl\WindowsAnytimeUpgradeResults.exe

          Filesize

          119KB

          MD5

          a4d8ba3f08458a308adf1909e01ebf8a

          SHA1

          bdc4be6169cf6620f6923d68a9eb450d953c9b38

          SHA256

          eca342c1342881e750ebbf4152320b887d09a6be641d7762cf23cccc6465e1c9

          SHA512

          d2d39395f47036ec480e468e9f3a8df0cb14ca9dfc1bd643ff1f7af71b07e49241585b4ecbba1f0ab9dce10a9e154c7ccd8fa2e74cd9b62a7487cf73a4b840c8

        • C:\Users\Admin\AppData\Local\I0MBl\WindowsAnytimeUpgradeResults.exe

          Filesize

          48KB

          MD5

          f5ee9a1a389cfa775d19c8b243c07cfc

          SHA1

          cd3ca4b78d5c739cced0c2ea19b3b103426dba1e

          SHA256

          28f4fb36813499b08db8ad61235bbb84228f20c871c95307bb1524f880818ec5

          SHA512

          111151db9854c92e4e4937f949bd32c74d535a3ef91b96fb1b46671c1c5837233aa17263a7e43234611f6437e6fac699706419526c2d3c6024c84783228fa4aa

        • C:\Users\Admin\AppData\Local\WzlF\slc.dll

          Filesize

          936KB

          MD5

          5b7b3b177a05bb3c88f408bdc36d0eab

          SHA1

          f2aeae6cfb0662d065e004813611656d25d461a3

          SHA256

          b38d1747e148627c2d7d9f5a5666fbae3eba7e5fe9a967f566f2b82ffd4ad764

          SHA512

          a86bfd3bde01f389d58ab3080cae388a3686a203583c75c286efedf4bcec8e3f0f79b5bd696d01e9f09640df36be288391e2c93cc7ab683113199ae6cd548ddc

        • C:\Users\Admin\AppData\Local\oP1YJUqQY\credui.dll

          Filesize

          936KB

          MD5

          6510e1f763d9c57570766e1eeaa45f44

          SHA1

          925039212921ede1cbfc8141d23946cedfb91f70

          SHA256

          d87a965e77996fc3f1955bda011245ccc57931fe59f00f7ae0490ae924fc9ea7

          SHA512

          f4ca528a61de9528d23619fc78dfeb4153c4f108321d5dc715a2caa2bfb34957df1baba7fa82ef3309ccd504261f38e137fcbb87f47b6917f2a15289304e6f2e

        • C:\Users\Admin\AppData\Roaming\Identities\ybMsdd\DUI70.dll

          Filesize

          222KB

          MD5

          e5a6697b862a52dfe1fb836b7b2da7a3

          SHA1

          272eddaa70ffaf031cf81cef1bcb696781994a92

          SHA256

          fc5abbd2289493ab59a0061886bbe1820ed4f15df33bf0061523077fc21cfb8f

          SHA512

          386cc1d04d8c10b2e51ad059a77fa3f4b18af672e809096b7fd9f0788c9717b793737621a5cc096fdbc8c58a226129591589234569051b5815fe1f05788f9390

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ekhyqsv.lnk

          Filesize

          1023B

          MD5

          e4052fe17f9a516971a1acc7c7c35987

          SHA1

          21d8baf7e052ff5c435cd76778feba18fd228b94

          SHA256

          e2fd71c0166bb34bb55d42f329c3a5a5bb141e95d5025f19008b93097a23b5f6

          SHA512

          a627689c7824f97ba6a356c9ee168f7d8b13b05cc87b5e7e43e30b5e458f51de4336ce6c6767c23f6426042c19158c96e825f55e585996ab8820b6fbd8407480

        • C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\23Q1I1A2\credui.dll

          Filesize

          639KB

          MD5

          d08723fd833c6edddc2eeb25a404bd11

          SHA1

          85fdddc7a9ed07e7bd5534db3dbfda418e3634a8

          SHA256

          e715152fd1481511d6a7528c0873231fc0d5a859a20712caf9cb965d895b15b9

          SHA512

          dc779688f35dc76fd79866cc6f497b4f9919291822e026addee6d6334146454643924420326c5784215309a453c68db06caa98f27eb43982e0272a7a2ebb0aea

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\bRAL\slc.dll

          Filesize

          7KB

          MD5

          44cf4ca34c0bbb82b6023e04e2592b7f

          SHA1

          993ba8d20ec2f3dd82308251540191a70801c287

          SHA256

          bee61487f3c0905e4f126dd3e52b2d6f7a1f0df725bc84d03622265e26c40441

          SHA512

          de60a04d8c3ef4e3df902e350136605d48a8e33f3bbfe86d37fffd1353b1b104bcdae2308768a303be6da9e628d2e590254be176c2ab9f4858e521863bb44892

        • \Users\Admin\AppData\Local\I0MBl\DUI70.dll

          Filesize

          110KB

          MD5

          09a598d589c74c9ead54cd1e5a45fa64

          SHA1

          e0c771cf37c265588d76f323aa65e9dceeb2862e

          SHA256

          b1a9300ea638ea81a6befeff77badb7cd074eec6d290d61bf8c7e93719dedb72

          SHA512

          1403739cb97a8635856b5408aa38485c1d6f6041dcbe8fcbc649e0cf5cdc62fd386d2d1050186da3b14bda0a69c57cba65d6eb8b702a5e0e5e87a58c6bd10ba6

        • \Users\Admin\AppData\Local\I0MBl\WindowsAnytimeUpgradeResults.exe

          Filesize

          147KB

          MD5

          589324d14a31291fbedac9791c4ae94f

          SHA1

          460bc63a186da4250b9e5ccc5e35ca0da392a8ef

          SHA256

          cee540948a789b677a262072166e7526847387764d2e05b83a9385811587f85d

          SHA512

          5818b3d7b216e3db68dfa8c105322afece3e83b2b218163ae19ad4a95e5d3d89e765e93bd936f73f5c392c7758368ee63d7874734af0929cf8a1a60cd7498552

        • \Users\Admin\AppData\Local\WzlF\rekeywiz.exe

          Filesize

          67KB

          MD5

          767c75767b00ccfd41a547bb7b2adfff

          SHA1

          91890853a5476def402910e6507417d400c0d3cb

          SHA256

          bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395

          SHA512

          f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9

        • \Users\Admin\AppData\Local\oP1YJUqQY\VaultSysUi.exe

          Filesize

          39KB

          MD5

          f40ef105d94350d36c799ee23f7fec0f

          SHA1

          ee3a5cfe8b807e1c1718a27eb97fa134360816e3

          SHA256

          eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2

          SHA512

          f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

        • \Users\Admin\AppData\Roaming\Identities\ybMsdd\WindowsAnytimeUpgradeResults.exe

          Filesize

          1KB

          MD5

          2ed4268820067ec145ba0a99a2bf7043

          SHA1

          56ed21b742d5b97c5d8ab5d002745d4dc6a43412

          SHA256

          65502f644b49be98a5e5f936fe5c8c91bdbf66147f468132d604fd0e15802cbc

          SHA512

          30869c4ee9195e07d0fcdebf8b672fc5f0b48d25302b1f8e4500377ee2699a4848474ef0f6a1cd3743049e51e79edb5960bb4188ef9f213e8c6d4ef5d79e0422

        • memory/776-93-0x0000000140000000-0x000000014011D000-memory.dmp

          Filesize

          1.1MB

        • memory/776-88-0x0000000140000000-0x000000014011D000-memory.dmp

          Filesize

          1.1MB

        • memory/776-89-0x0000000000300000-0x0000000000307000-memory.dmp

          Filesize

          28KB

        • memory/1212-41-0x0000000077996000-0x0000000077997000-memory.dmp

          Filesize

          4KB

        • memory/1212-7-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-14-0x00000000029C0000-0x00000000029C7000-memory.dmp

          Filesize

          28KB

        • memory/1212-3-0x0000000077996000-0x0000000077997000-memory.dmp

          Filesize

          4KB

        • memory/1212-13-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-4-0x00000000029E0000-0x00000000029E1000-memory.dmp

          Filesize

          4KB

        • memory/1212-6-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-22-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-36-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-8-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-34-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-24-0x0000000077C30000-0x0000000077C32000-memory.dmp

          Filesize

          8KB

        • memory/1212-9-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-11-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-12-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-10-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/1212-23-0x0000000077C00000-0x0000000077C02000-memory.dmp

          Filesize

          8KB

        • memory/1960-76-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/1960-72-0x00000000002F0000-0x00000000002F7000-memory.dmp

          Filesize

          28KB

        • memory/2012-56-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/2012-51-0x0000000001D20000-0x0000000001D27000-memory.dmp

          Filesize

          28KB

        • memory/2012-52-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/2524-33-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/2524-0-0x00000000001A0000-0x00000000001A7000-memory.dmp

          Filesize

          28KB

        • memory/2524-1-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB