Analysis

  • max time kernel
    1s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2023 22:21

General

  • Target

    057bb2ade128476e59bac8ad60086d9e.dll

  • Size

    3.2MB

  • MD5

    057bb2ade128476e59bac8ad60086d9e

  • SHA1

    63c16b30db7718bc853802ede3e3d3f8563f7a5c

  • SHA256

    2fd1f1b0c7fb142aa3c4e81bedb7e6722acede96384123b60c86b2dca501b50a

  • SHA512

    3bbeba9f3ceae53a739e2689be4cb57cea9f96ee2aeb61ee3f118d3963fcfea082c05f0a1c162887a554c4b2289a4766fb6b9e8b14cc6911ad07a036429a6d61

  • SSDEEP

    12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\057bb2ade128476e59bac8ad60086d9e.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3180
  • C:\Windows\system32\DWWIN.EXE
    C:\Windows\system32\DWWIN.EXE
    1⤵
      PID:3036
    • C:\Users\Admin\AppData\Local\iKEJno\DWWIN.EXE
      C:\Users\Admin\AppData\Local\iKEJno\DWWIN.EXE
      1⤵
        PID:2268
      • C:\Windows\system32\WMPDMC.exe
        C:\Windows\system32\WMPDMC.exe
        1⤵
          PID:1568
        • C:\Users\Admin\AppData\Local\W37Ok1My\WMPDMC.exe
          C:\Users\Admin\AppData\Local\W37Ok1My\WMPDMC.exe
          1⤵
            PID:4944
          • C:\Users\Admin\AppData\Local\Fg5wWVuQ6\wlrmdr.exe
            C:\Users\Admin\AppData\Local\Fg5wWVuQ6\wlrmdr.exe
            1⤵
              PID:4156

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2268-96-0x000001B13B490000-0x000001B13B497000-memory.dmp

              Filesize

              28KB

            • memory/3180-1-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3180-6-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3180-0-0x000001DFFCA70000-0x000001DFFCA77000-memory.dmp

              Filesize

              28KB

            • memory/3540-49-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-11-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-20-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-24-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-29-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-32-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-35-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-39-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-42-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-46-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-48-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-55-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-58-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-61-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-64-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-67-0x0000000000840000-0x0000000000847000-memory.dmp

              Filesize

              28KB

            • memory/3540-65-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-75-0x00007FF8BB780000-0x00007FF8BB790000-memory.dmp

              Filesize

              64KB

            • memory/3540-63-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-62-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-60-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-12-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-59-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-57-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-56-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-54-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-52-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-53-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-4-0x0000000006F90000-0x0000000006F91000-memory.dmp

              Filesize

              4KB

            • memory/3540-9-0x00007FF8BB59A000-0x00007FF8BB59B000-memory.dmp

              Filesize

              4KB

            • memory/3540-8-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-17-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-51-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-47-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-45-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-44-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-43-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-41-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-40-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-38-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-37-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-36-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-34-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-33-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-31-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-30-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-28-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-27-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-26-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-25-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-23-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-22-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-21-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-19-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-18-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-16-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-15-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-14-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-13-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-7-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-10-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/3540-50-0x0000000140000000-0x0000000140338000-memory.dmp

              Filesize

              3.2MB

            • memory/4156-112-0x000001DF5CC50000-0x000001DF5CC57000-memory.dmp

              Filesize

              28KB

            • memory/4944-131-0x000002B56EA10000-0x000002B56EA17000-memory.dmp

              Filesize

              28KB