Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2023 20:39

General

  • Target

    0363154b6154c58e1968193a92704afc.dll

  • Size

    2.0MB

  • MD5

    0363154b6154c58e1968193a92704afc

  • SHA1

    cefe766c0f88c2ca05a0d84ad75a7c65cf51f484

  • SHA256

    5828977b2ceed7da8ad59af7255116b6eacb7624a0106f0604bc3ce29e4470be

  • SHA512

    772f23f5b47f9802caad4d0f693dc5cba562eb2028e3a20aa0120989b5c5e0a88c6ce037e6cf3dfada990bd936d05fe0d56403f101fcc6639ac11a5e2af56ab6

  • SSDEEP

    12288:3VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:+fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0363154b6154c58e1968193a92704afc.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1936
  • C:\Windows\system32\cmstp.exe
    C:\Windows\system32\cmstp.exe
    1⤵
      PID:2604
    • C:\Users\Admin\AppData\Local\Sty7\cmstp.exe
      C:\Users\Admin\AppData\Local\Sty7\cmstp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3008
    • C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
      C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
      1⤵
        PID:580
      • C:\Users\Admin\AppData\Local\b5RKrJx8\WindowsAnytimeUpgradeResults.exe
        C:\Users\Admin\AppData\Local\b5RKrJx8\WindowsAnytimeUpgradeResults.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1504
      • C:\Windows\system32\calc.exe
        C:\Windows\system32\calc.exe
        1⤵
          PID:2548
        • C:\Users\Admin\AppData\Local\xsrtXrPyV\calc.exe
          C:\Users\Admin\AppData\Local\xsrtXrPyV\calc.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2204

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Sty7\VERSION.dll

          Filesize

          534KB

          MD5

          4d9922b64ec28fe7f5407d029e258a14

          SHA1

          dc9522de709d2f208f03570f474c462573e6ee0a

          SHA256

          a30207d8c4afbaf64f618a04235e48983fec117c34da1ebfce38c9872e4f6b01

          SHA512

          2f885c0b6f54b953b3ee0cd8764f7e2846a65257166e378bf3c2bbcb3e51c28e0bba3ab38d690332f0b3a8367c77484b139ce55768463f07074f0d8dcf39dbfd

        • C:\Users\Admin\AppData\Local\Sty7\cmstp.exe

          Filesize

          45KB

          MD5

          13387444219b21ee9e6f109ac7590db7

          SHA1

          7ac23cf68d83d5a2f70c3cf8a50352bad59037ef

          SHA256

          e2d8514882b6306e81dba9476380050ace0d35fe9aac63fb7f9972b5066fe4ea

          SHA512

          c183e5fe7b7e4acced92e49a29ba1c4b86fd1c8ba8a232a98b61db52fadb4ed73ce5a35643db56e6b005884d4bd5ddf7130175b812a93d3582582e97c0d1f8d6

        • C:\Users\Admin\AppData\Local\Sty7\cmstp.exe

          Filesize

          90KB

          MD5

          74c6da5522f420c394ae34b2d3d677e3

          SHA1

          ba135738ef1fb2f4c2c6c610be2c4e855a526668

          SHA256

          51d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6

          SHA512

          bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a

        • C:\Users\Admin\AppData\Local\b5RKrJx8\DUI70.dll

          Filesize

          651KB

          MD5

          761f682984b464d50dbeb95dc526234e

          SHA1

          4c52076ce1a248c81050415cd28ca05f1cbb8e88

          SHA256

          bdf17e5462435eee34b4c16c09db0eb38fe2e91abd9d3f2e364b8e8128ec2b9d

          SHA512

          6b977fec3e92a21bc628b00cedb448c9a9d877d90507ba14d204db4b6b27ca77f90f07ee7b657e98ed1e7ce07606f35c169ed7aea150c7cdd58b0251e5f2c2d0

        • C:\Users\Admin\AppData\Local\b5RKrJx8\WindowsAnytimeUpgradeResults.exe

          Filesize

          288KB

          MD5

          6f3f29905f0ec4ce22c1fd8acbf6c6de

          SHA1

          68bdfefe549dfa6262ad659f1578f3e87d862773

          SHA256

          e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b

          SHA512

          16a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e

        • C:\Users\Admin\AppData\Local\xsrtXrPyV\UxTheme.dll

          Filesize

          196KB

          MD5

          35467544c6adc6d1b10000ce905b562f

          SHA1

          3d0b8eeccf01183025b07f6f2e78122bbbf62c3d

          SHA256

          782b87ae521b2b414ee354ffc9273deb97d7227c8ec28245924d7379cc6b27db

          SHA512

          f82b4e807ff87cbf09992116c3dfa4eaa12416dead7d5febda9848b5961f9d9c583a454eb4333caf7845a4496183c57882ffaf31c18d98c905620ee8002af8bd

        • C:\Users\Admin\AppData\Local\xsrtXrPyV\calc.exe

          Filesize

          246KB

          MD5

          35b387ec3ac1fb60ed5e4c5fa15a6caf

          SHA1

          adda5a47ac43f08508537350f116fa82f2198030

          SHA256

          1228dac5cf8a64348864671cb0b3ae69195a60fe306d66c63ec7d9ab5e59b7c6

          SHA512

          d5bd9df9ef613f8877807d24108d3c8d28da30dce1d21f2c77411a046d89f5c64a11946d53c993a2486e498928f2a5bccd999dc4f896e0e8687d946e41887f11

        • C:\Users\Admin\AppData\Local\xsrtXrPyV\calc.exe

          Filesize

          861KB

          MD5

          c20ed8d016f30a6541e31a43953c50fb

          SHA1

          add6547eb739886168ec2f066d6cafe6aebf4937

          SHA256

          d04da6d5e0778742aa387062c5a47b496237b6a3337ffc4607965e1e0f3392f1

          SHA512

          8df68eec9a2fe364f9aa598c52809336a263798a825e88e80442c788abadfd8ffefa17a8ce50a0869f203a77e2ace9b3b3041486477db43a6e070e82bd10daa1

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

          Filesize

          1KB

          MD5

          e78096cd2d0b380a968f04ab539686e3

          SHA1

          5eeadaef2e3ae12dcfd7f2dc09c9f427a4b8c9f3

          SHA256

          d6ca32341bdee0288b09cbf48442b56129b169090038d3a0cf26c683c1c39309

          SHA512

          88c400b1a63b29cd6e0f941498b48ded6549e409f34e3cfc4813b1fb4e84f8be1e9452d73d790d967bd685d02bd4134d5ca5f73e98e129e374f7d03c289eaabc

        • C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\LWtvG\UxTheme.dll

          Filesize

          2.0MB

          MD5

          2f5df2fd962eb7390740ced51ab94edc

          SHA1

          7c1ac8c01bfc1c106ea41ee960b5054ec364a446

          SHA256

          aca94156ac148cda6e6a2a9c8ed7beda4081bde7ce328903af6ec0da431cd30a

          SHA512

          f88fd3ba81d499a0c01f298bf4e43ba45b9781ee5de068907f3fa44a6e5123beabc5f1dbf956f28a89d3069df116c8780a9d8aea9874d83f1198f62045628d6e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\mErbdODUp\VERSION.dll

          Filesize

          2.0MB

          MD5

          cafcbe227238b930e9d428f6499559d7

          SHA1

          f285f9b70c26515bbcc2a5b7b164a5eb7b861050

          SHA256

          c20ab471273f428b31ac6df55ffe591bc94f9254928f442863fdda277a43f4c0

          SHA512

          7c0131ff191218c6c67a692ca8344274b26295a84ebb21a0f47d0b13c8a1e48717020917792303c4058eee74432a106173ead59133fa9b0188feef7014a8cf57

        • C:\Users\Admin\AppData\Roaming\Microsoft\Hgj0xJjyBk\DUI70.dll

          Filesize

          2.2MB

          MD5

          e7e7215c0e80334f37467cbc759f78c3

          SHA1

          c8b5b7c077a6db3c2cbcba824d523c295d766590

          SHA256

          946072bdca080cf8d7d271954e61e82323db06ef6c7b65607c9ff359ca736538

          SHA512

          dfda1293565ef07eab5ab4311a8db187994233b39606c453fde80c1bd2ba6694e32a00af7aea51626b026ae3d676837c53f9b9917e333cc93edeedbbebb8f828

        • \Users\Admin\AppData\Local\Sty7\VERSION.dll

          Filesize

          438KB

          MD5

          5f2a3394213ea01e618e9d2d5908b4f7

          SHA1

          3f2a66bf8c16967dbf903ba7265a0f6c4a297dcb

          SHA256

          833167991c2efb13c10232f493b2b0dfe7385b7f943f18258ff5ae2c0b419119

          SHA512

          f4717bd4929db410ce55f7f0a6ae6f45a10daa3e7b52c635276e5be7a1b2b8508b266f1a4e5a7e59593bfe4117b50c428d9ac734ca8a3516f3669325f5665c04

        • \Users\Admin\AppData\Local\Sty7\cmstp.exe

          Filesize

          57KB

          MD5

          82ff66366bef7167fba789a283e2f0f7

          SHA1

          822b52d941c3c01c3638862453e8706ff13d544f

          SHA256

          2971873d9dbeac0e6a89a5481123ba98dc059721268e8e2da000af63d6a84ec9

          SHA512

          709d8d5f8d7c6176fdb4327c18feedfcc4303eb0b468a3787cb88edc466a2ecf9f1e75d2ff107531d14272b940488c9174169a9648c6e7c74bd3ec095b6d9835

        • \Users\Admin\AppData\Local\b5RKrJx8\DUI70.dll

          Filesize

          1.1MB

          MD5

          6c8562b266a3fcf57236e20a19d12a82

          SHA1

          3c8239bfa7bcb0256489c5a4d4b2fbc75a93cce6

          SHA256

          ce042790cabc50b32bef40915203056bb0d3ea990773ed501a88ea1754ded2e9

          SHA512

          9bbbc4aad04887afe10a0e1ce9e9879318dbd65039ca3a5b39df97e763fa442bd2a7cd32a3b93380f0fabeda257ff51fec1ce84f5884176088ddb34eaa6ab2b1

        • \Users\Admin\AppData\Local\xsrtXrPyV\UxTheme.dll

          Filesize

          96KB

          MD5

          d473ef3adf95e7841e118f142d2b5a31

          SHA1

          3302f62cb77f1666aef7e9c1999a08c181c066e6

          SHA256

          618c1791d05e5027650885958af86d169db59e9bf409fc6c29c106d36925f91f

          SHA512

          1fbfb817f5fc0334e514bb69be787c65e203d713c2ded014daefdc57b24ffd8dd529d45a9f9df970ba1fdf0ea74b7cc37e3021c5072866990b959122465da254

        • \Users\Admin\AppData\Local\xsrtXrPyV\calc.exe

          Filesize

          213KB

          MD5

          c4a066139b7fd09fcb67bf15f831c30b

          SHA1

          1669eee39602f14e6ede84372ba935f155a8d5e4

          SHA256

          14f240b970fc1f24048db1c93d5e322a3a6d76af6990e373cc9bf1d38b727a82

          SHA512

          46fa0d109581dc88a54b059c3fb0bcc603b532f382f0adbd2ce547d693166932f096e207b1dfc69b305628c800765fd4eb715e1a02c7d197f6e6988bc69edd4e

        • \Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\LWtvG\calc.exe

          Filesize

          580KB

          MD5

          4d34b1f99259fae461fc97d5507fc9e6

          SHA1

          5b183cf7efc6b9be19dadf51bd6b4c0846d83958

          SHA256

          687ae704c56949c80eb5a340b6ed9e8c4f973a907915bd46c2b2db0d0f2eb36b

          SHA512

          82e3627d89f0e264b5a728704d17250d1ba412f4e925cd979f7af49a6abda62a98ef79a9167e4cf6ded8edfeeeef71b48c305192921d509cbf9e8c5182c6bbc7

        • memory/1224-20-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-19-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-23-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-22-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-21-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-18-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-28-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-27-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-33-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-34-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-35-0x0000000002C30000-0x0000000002C37000-memory.dmp

          Filesize

          28KB

        • memory/1224-32-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-31-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-30-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-29-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-42-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-43-0x0000000077811000-0x0000000077812000-memory.dmp

          Filesize

          4KB

        • memory/1224-47-0x0000000077970000-0x0000000077972000-memory.dmp

          Filesize

          8KB

        • memory/1224-53-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-59-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-26-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-24-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-4-0x0000000077606000-0x0000000077607000-memory.dmp

          Filesize

          4KB

        • memory/1224-25-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-5-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/1224-7-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-17-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-9-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-98-0x0000000077606000-0x0000000077607000-memory.dmp

          Filesize

          4KB

        • memory/1224-16-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-15-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-14-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-12-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-11-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-13-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-10-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1504-112-0x0000000140000000-0x000000014022C000-memory.dmp

          Filesize

          2.2MB

        • memory/1504-107-0x0000000140000000-0x000000014022C000-memory.dmp

          Filesize

          2.2MB

        • memory/1504-106-0x0000000000310000-0x0000000000317000-memory.dmp

          Filesize

          28KB

        • memory/1936-8-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1936-0-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/1936-1-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/2204-124-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2204-129-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/3008-97-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/3008-71-0x0000000140000000-0x00000001401F9000-memory.dmp

          Filesize

          2.0MB

        • memory/3008-72-0x0000000000080000-0x0000000000087000-memory.dmp

          Filesize

          28KB