Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2023 22:27

General

  • Target

    0597e704a1234f7f0a2cc4dd823194cb.dll

  • Size

    712KB

  • MD5

    0597e704a1234f7f0a2cc4dd823194cb

  • SHA1

    50e72b88256c7807853bea80c0c660a503383f75

  • SHA256

    7ba44f9bf826852b97d7fd37af4450957684acdea533f27440e8bfb5db1cd729

  • SHA512

    368b8672d5e1123fe15021264390d71482aae6b52cea5089afeaeed63ebf89c60addede65dd8ae1409c74e1f05009eb5f0e02e5326fa49f617fe36502b12f75c

  • SSDEEP

    12288:1dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:bMIJxSDX3bqjhcfHk7MzH6z

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 10 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0597e704a1234f7f0a2cc4dd823194cb.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1232
  • C:\Windows\system32\wusa.exe
    C:\Windows\system32\wusa.exe
    1⤵
      PID:2600
    • C:\Users\Admin\AppData\Local\LlJ\wusa.exe
      C:\Users\Admin\AppData\Local\LlJ\wusa.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2288
    • C:\Windows\system32\winlogon.exe
      C:\Windows\system32\winlogon.exe
      1⤵
        PID:700
      • C:\Users\Admin\AppData\Local\D26i\winlogon.exe
        C:\Users\Admin\AppData\Local\D26i\winlogon.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1168
      • C:\Windows\system32\DeviceDisplayObjectProvider.exe
        C:\Windows\system32\DeviceDisplayObjectProvider.exe
        1⤵
          PID:1628
        • C:\Users\Admin\AppData\Local\8qH\DeviceDisplayObjectProvider.exe
          C:\Users\Admin\AppData\Local\8qH\DeviceDisplayObjectProvider.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2568

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\8qH\XmlLite.dll

          Filesize

          716KB

          MD5

          105e73dbca8f4514f3a53b1cc83afe55

          SHA1

          06cecc793a136b1531cc5777b5e49177b3e1beab

          SHA256

          a1c8b14932039df84472f156ca028e82b1d3061faf6140164894a53310915cc8

          SHA512

          c02a422be31512868c7489f242589aba1f8db421639d3eff95b776960bedf39645e9d12ecc8ee9d8e580bd5487c9f3c75606272f8727355d29276ce04362d3d9

        • C:\Users\Admin\AppData\Local\D26i\WINSTA.dll

          Filesize

          720KB

          MD5

          fa0170f26463a68bc38cd50860777745

          SHA1

          303ee82cfb90473baa76c8ef2118ce1cbccb8f16

          SHA256

          65e6e9f0cf8e81212dd8b0fae1acbb733583aed3311ea8855d4cbaa8eb74fb97

          SHA512

          9db4f8edc8f73213fa67e66a8799ec54f3d5dcab9b78ba6fd89a9915e5046dfd79f87fb5b320396ca48c171582bcecd15ea3de06ac23fcf3f520800969aaaefa

        • C:\Users\Admin\AppData\Local\LlJ\WTSAPI32.dll

          Filesize

          716KB

          MD5

          5be419bd9e1f507f93d7d2912f1bed49

          SHA1

          d04d3f8215051c3f042b5f18a18446d6ab9167e8

          SHA256

          88e5fb81b7c53b941b4bb31bbe381d92d3b7817b1e234a7a8e156de545458ab4

          SHA512

          aeb82e359773982074ba1d3340aa856b01bc0fd6026d346e03612693ad1686ccbdee4abde883294732c93c7ad3acf04561b5bf8e4646aeb46a18054aae28e142

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

          Filesize

          1KB

          MD5

          274cef091c3344f25cf27b9807e15d92

          SHA1

          0aeb3386a8983d5e05df9d3d18d71f8794983cf9

          SHA256

          ce3ca6eaaa6da9a6c3b0ef5bb853291832dc1cb33b2efc0f5b399a62cd178111

          SHA512

          696cd1e3460603a1e8440de5ddcca6646721b36da9ab9edc7513eb06ede5d26f9469825d2304169daafeb9892e298408d67a7547f0768124137d48ca619d775c

        • \Users\Admin\AppData\Local\8qH\DeviceDisplayObjectProvider.exe

          Filesize

          109KB

          MD5

          7e2eb3a4ae11190ef4c8a9b9a9123234

          SHA1

          72e98687a8d28614e2131c300403c2822856e865

          SHA256

          8481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0

          SHA512

          18b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf

        • \Users\Admin\AppData\Local\D26i\winlogon.exe

          Filesize

          381KB

          MD5

          1151b1baa6f350b1db6598e0fea7c457

          SHA1

          434856b834baf163c5ea4d26434eeae775a507fb

          SHA256

          b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49

          SHA512

          df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab

        • \Users\Admin\AppData\Local\LlJ\wusa.exe

          Filesize

          300KB

          MD5

          c15b3d813f4382ade98f1892350f21c7

          SHA1

          a45c5abc6751bc8b9041e5e07923fa4fc1b4542b

          SHA256

          8f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3

          SHA512

          6d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c

        • memory/1168-78-0x0000000140000000-0x00000001400B4000-memory.dmp

          Filesize

          720KB

        • memory/1168-74-0x0000000140000000-0x00000001400B4000-memory.dmp

          Filesize

          720KB

        • memory/1232-0-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/1232-1-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1232-48-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-30-0x0000000077A80000-0x0000000077A82000-memory.dmp

          Filesize

          8KB

        • memory/1248-12-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-20-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-19-0x0000000002100000-0x0000000002107000-memory.dmp

          Filesize

          28KB

        • memory/1248-16-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-15-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-13-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-28-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-18-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-29-0x0000000077A50000-0x0000000077A52000-memory.dmp

          Filesize

          8KB

        • memory/1248-40-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-39-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-14-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-17-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-11-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-3-0x00000000776E6000-0x00000000776E7000-memory.dmp

          Filesize

          4KB

        • memory/1248-4-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/1248-6-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-66-0x00000000776E6000-0x00000000776E7000-memory.dmp

          Filesize

          4KB

        • memory/1248-10-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-9-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-8-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1248-7-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/2288-61-0x0000000140000000-0x00000001400B3000-memory.dmp

          Filesize

          716KB

        • memory/2288-57-0x0000000140000000-0x00000001400B3000-memory.dmp

          Filesize

          716KB

        • memory/2288-56-0x00000000000E0000-0x00000000000E7000-memory.dmp

          Filesize

          28KB

        • memory/2568-90-0x0000000000070000-0x0000000000077000-memory.dmp

          Filesize

          28KB

        • memory/2568-95-0x0000000140000000-0x00000001400B3000-memory.dmp

          Filesize

          716KB