Analysis

  • max time kernel
    154s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2023 05:07

General

  • Target

    c60920a9c292aa669035396b03965a08.dll

  • Size

    932KB

  • MD5

    c60920a9c292aa669035396b03965a08

  • SHA1

    c6005bcff4c1a3161bdc681b68ddadb2b771a5b6

  • SHA256

    4e37a17479c456a66c1b5bbc8204e65e2a7049852836df593d3cffad7ea546c9

  • SHA512

    e5b79d76ea45af823612782d5c1c6426084c6cfab908d5bb5db4134b24e9f91ee3bd291e1da2dbb9b3801483926b767b2ad1b9c35c02d7ab4177893d630a2797

  • SSDEEP

    12288:yPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK88:ytKTrsKSKBTSb6DUXWq88

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 8 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4888
  • C:\Windows\system32\dxgiadaptercache.exe
    C:\Windows\system32\dxgiadaptercache.exe
    1⤵
      PID:3500
    • C:\Users\Admin\AppData\Local\a1Ac\dxgiadaptercache.exe
      C:\Users\Admin\AppData\Local\a1Ac\dxgiadaptercache.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3800
    • C:\Windows\system32\msra.exe
      C:\Windows\system32\msra.exe
      1⤵
        PID:1068
      • C:\Users\Admin\AppData\Local\EP6w\msra.exe
        C:\Users\Admin\AppData\Local\EP6w\msra.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4700
      • C:\Windows\system32\msconfig.exe
        C:\Windows\system32\msconfig.exe
        1⤵
          PID:4384
        • C:\Users\Admin\AppData\Local\XuPoT1\msconfig.exe
          C:\Users\Admin\AppData\Local\XuPoT1\msconfig.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:836

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\EP6w\UxTheme.dll

          Filesize

          936KB

          MD5

          4643581cd4fdac26ac9eb7bb39bfb132

          SHA1

          54821b1e6bf4f614dd3c2fc405421da5ab080f96

          SHA256

          00daa76f3862d79a2a87fe0a29bd163527d4b29cac23d5a5adc4695a829738c9

          SHA512

          75dda9fdb887bca25b75cbc71ed5acff8879ecd8e8f48aa4af8ba2809a9bbd6976113abb87f27fb9500e92087c490d4ca45c50126c7f13cdaff6df37c0462add

        • C:\Users\Admin\AppData\Local\EP6w\msra.exe

          Filesize

          579KB

          MD5

          dcda3b7b8eb0bfbccb54b4d6a6844ad6

          SHA1

          316a2925e451f739f45e31bc233a95f91bf775fa

          SHA256

          011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae

          SHA512

          18e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5

        • C:\Users\Admin\AppData\Local\XuPoT1\VERSION.dll

          Filesize

          936KB

          MD5

          7c2d965c2208841f24d43a575b828f8d

          SHA1

          233308ffddd2e06d0511d0ff2b5808f3ec44ab9a

          SHA256

          afb59f464f1ec5d2b8fdae055110f2ecafa57e779ba347a04d041be5b1487d6f

          SHA512

          c78d2195f6771b2b2b5004319d6a9df3f921a9bb949ccfc55142397e004d2d864be962a78bdaa525227fbae81679a2d020d7e13bada7f443bf108b073fd2e87c

        • C:\Users\Admin\AppData\Local\XuPoT1\msconfig.exe

          Filesize

          193KB

          MD5

          39009536cafe30c6ef2501fe46c9df5e

          SHA1

          6ff7b4d30f31186de899665c704a105227704b72

          SHA256

          93d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04

          SHA512

          95c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a

        • C:\Users\Admin\AppData\Local\a1Ac\dxgi.dll

          Filesize

          936KB

          MD5

          492ecb555b3aa4793f92bafb27777acf

          SHA1

          9cd923cac995853122f5d6eeec53664bae1c6792

          SHA256

          f5bf9f7c186ff381cd0c79591596fe4f1be00cf825750896137594505d5804cb

          SHA512

          57e31e9430c375896ad720a72cbb18ab75e544fe33403def39267459d0a928f51ecb9309f3a5617e0a1f24ec135b2537935994d5a0d4332fd4b95dbaf27c5223

        • C:\Users\Admin\AppData\Local\a1Ac\dxgiadaptercache.exe

          Filesize

          230KB

          MD5

          e62f89130b7253f7780a862ed9aff294

          SHA1

          b031e64a36e93f95f2061be5b0383069efac2070

          SHA256

          4bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5

          SHA512

          05649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          b19b6b82aed04484820ea294493ff734

          SHA1

          54b6b4de35057a2e147d1d70363bda8f6c033b56

          SHA256

          3577dab3edb4915b972be78450db1bcfa2a57e9c2afdeaf4b05a8d0add899968

          SHA512

          5f143e7bd16979c39d10bfc9d92bb4a4af78a8e7dcebdbae0c20c5c26b50cd3c62fdd622d10dbc64bf09bab3c04dd4379e79ab0fa39b550091b84fba9cb67088

        • memory/836-82-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/836-77-0x000001E2D5D10000-0x000001E2D5D17000-memory.dmp

          Filesize

          28KB

        • memory/3520-11-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-33-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-14-0x0000000001350000-0x0000000001357000-memory.dmp

          Filesize

          28KB

        • memory/3520-13-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-22-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-23-0x00007FFE789A0000-0x00007FFE789B0000-memory.dmp

          Filesize

          64KB

        • memory/3520-24-0x00007FFE78990000-0x00007FFE789A0000-memory.dmp

          Filesize

          64KB

        • memory/3520-9-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-3-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

          Filesize

          4KB

        • memory/3520-8-0x00007FFE77E5A000-0x00007FFE77E5B000-memory.dmp

          Filesize

          4KB

        • memory/3520-5-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-12-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-6-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-7-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3520-10-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/3800-43-0x000002890F550000-0x000002890F557000-memory.dmp

          Filesize

          28KB

        • memory/3800-48-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/3800-44-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/4700-59-0x000002B03D820000-0x000002B03D827000-memory.dmp

          Filesize

          28KB

        • memory/4700-64-0x0000000140000000-0x00000001400EA000-memory.dmp

          Filesize

          936KB

        • memory/4888-1-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/4888-36-0x0000000140000000-0x00000001400E9000-memory.dmp

          Filesize

          932KB

        • memory/4888-0-0x00000263F7EA0000-0x00000263F7EA7000-memory.dmp

          Filesize

          28KB