Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2023 23:05

General

  • Target

    06757f0f902f5be0f5997657f6eb9265.dll

  • Size

    1.7MB

  • MD5

    06757f0f902f5be0f5997657f6eb9265

  • SHA1

    e6a16036b2f2b471440093625ff7712b274b3a88

  • SHA256

    ae2ad50601ea9427bbd5976872c8854d51b8411b1d542a6df8d32169b62848ec

  • SHA512

    3694179f2495a0f92bee6096f1a4c7cde9f1b0953051ce9d9e618a72548410d12362d6ca3204c803d3e6f234d80c56cb62150d958f33c15afcbd262b22ef5015

  • SSDEEP

    12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\06757f0f902f5be0f5997657f6eb9265.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2000
  • C:\Windows\system32\Netplwiz.exe
    C:\Windows\system32\Netplwiz.exe
    1⤵
      PID:3028
    • C:\Users\Admin\AppData\Local\92E4R\Netplwiz.exe
      C:\Users\Admin\AppData\Local\92E4R\Netplwiz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:912
    • C:\Windows\system32\wextract.exe
      C:\Windows\system32\wextract.exe
      1⤵
        PID:2584
      • C:\Users\Admin\AppData\Local\IfUgxvo\wextract.exe
        C:\Users\Admin\AppData\Local\IfUgxvo\wextract.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2824
      • C:\Windows\system32\rdpshell.exe
        C:\Windows\system32\rdpshell.exe
        1⤵
          PID:2908
        • C:\Users\Admin\AppData\Local\Ixyx\rdpshell.exe
          C:\Users\Admin\AppData\Local\Ixyx\rdpshell.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2792

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\92E4R\NETPLWIZ.dll

          Filesize

          1.7MB

          MD5

          0f26c96cab988349f4837dfa51269d41

          SHA1

          3c245325b737a4e3f3b656e2387898463d1ec551

          SHA256

          5907a2aadde2e043cce921a5fdc67d6e953cc9c0261d39567896f11bb36556fa

          SHA512

          24005c42a8fb671412ad6927c54fe346abb66f710955e43c1cdf0fe9b7206d5145bfc5930a703a0be6a96618869f57739048f292d742455d8b3cd9a8539e46b9

        • C:\Users\Admin\AppData\Local\IfUgxvo\VERSION.dll

          Filesize

          1.7MB

          MD5

          55404af70ad6f761dec2483681dde95c

          SHA1

          11bcb4664613afbd0ee8783ad6c791194012de0e

          SHA256

          243d5b51f69b7b5631eca48cf870c1ec7589d23fddb03213d72b17b6fbee9e99

          SHA512

          29831fdcf36f289550b3971d620b9ea3170766353c305e352df71b2e19ef2cefa33bbe5a9accd8582a508ebadce80fad848ebfbce37f6a3e90bd803914081eef

        • C:\Users\Admin\AppData\Local\Ixyx\WTSAPI32.dll

          Filesize

          1.7MB

          MD5

          573ecdfb11e15ad2792c704f0b4381f3

          SHA1

          290b95d02611ebf941319afc1fcacb9d90f8a95d

          SHA256

          cb480da37e646ae60303ff95bf99bac3e570b05db80a07fe33cdd607d66ef038

          SHA512

          61f6e38371c07ca88887f6e0d80109040a8ed86285b04881897500b93f7a5a0d029394884bd47fd56f053b32748011e47f21a4e2e27d62c7a1d8ecae48d208df

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          08123b4b785085a51376d425aeb2da3e

          SHA1

          97babed3e0dda49ca7ab343ff737b47de1c2c315

          SHA256

          c4d71981dce95b763343afd5527f504a6c3ab6aa860b57bc4ba84688b795013c

          SHA512

          349191e4c222d189466e8061abd1737c5f3d07e51131c128e6387c38c19de8ef84c37a6493a3c21de09c55318f2dce49fe2a1e9bf1d8d3e7c87587c3a3cfa2cf

        • \Users\Admin\AppData\Local\92E4R\Netplwiz.exe

          Filesize

          26KB

          MD5

          e43ec3c800d4c0716613392e81fba1d9

          SHA1

          37de6a235e978ecf3bb0fc2c864016c5b0134348

          SHA256

          636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c

          SHA512

          176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

        • \Users\Admin\AppData\Local\IfUgxvo\wextract.exe

          Filesize

          140KB

          MD5

          1ea6500c25a80e8bdb65099c509af993

          SHA1

          6a090ef561feb4ae1c6794de5b19c5e893c4aafc

          SHA256

          99123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2

          SHA512

          b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb

        • \Users\Admin\AppData\Local\Ixyx\rdpshell.exe

          Filesize

          292KB

          MD5

          a62dfcea3a58ba8fcf32f831f018fe3f

          SHA1

          75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b

          SHA256

          f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e

          SHA512

          9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

        • memory/912-86-0x0000000140000000-0x00000001401BB000-memory.dmp

          Filesize

          1.7MB

        • memory/912-80-0x0000000000410000-0x0000000000417000-memory.dmp

          Filesize

          28KB

        • memory/912-81-0x0000000140000000-0x00000001401BB000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-36-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-41-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-18-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-19-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-20-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-21-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-23-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-22-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-25-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-24-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-26-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-27-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-28-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-29-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-31-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-30-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-32-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-33-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-34-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-35-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-4-0x00000000778E6000-0x00000000778E7000-memory.dmp

          Filesize

          4KB

        • memory/1308-37-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-39-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-38-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-40-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-17-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-42-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-43-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-44-0x0000000002A90000-0x0000000002A97000-memory.dmp

          Filesize

          28KB

        • memory/1308-51-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-52-0x0000000077AF1000-0x0000000077AF2000-memory.dmp

          Filesize

          4KB

        • memory/1308-53-0x0000000077C50000-0x0000000077C52000-memory.dmp

          Filesize

          8KB

        • memory/1308-62-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-68-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-70-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-16-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-15-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-14-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-13-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-12-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-10-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-11-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-5-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

          Filesize

          4KB

        • memory/1308-138-0x00000000778E6000-0x00000000778E7000-memory.dmp

          Filesize

          4KB

        • memory/1308-7-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1308-9-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2000-8-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2000-1-0x0000000140000000-0x00000001401BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2000-0-0x0000000000330000-0x0000000000337000-memory.dmp

          Filesize

          28KB

        • memory/2792-116-0x00000000001A0000-0x00000000001A7000-memory.dmp

          Filesize

          28KB

        • memory/2824-99-0x0000000000320000-0x0000000000327000-memory.dmp

          Filesize

          28KB