Analysis

  • max time kernel
    3s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 00:26

General

  • Target

    08813f878cb82d72137f676d7e09709d.dll

  • Size

    2.5MB

  • MD5

    08813f878cb82d72137f676d7e09709d

  • SHA1

    f88f26f38331241120189c141189e91d8ca4dd50

  • SHA256

    d019c751d5e32cf0c6ae6a66e17f3c47b9ab46b76eea50f8d5e450841060c8ac

  • SHA512

    8d363518c30a7c18c5efba51af8a9eb517e2995ae3e11da66231badbea752b861a00f71bee7635498b536400c9dab1e24fffa92c7e6ccbd10e6e2b24319c3cfc

  • SSDEEP

    12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\08813f878cb82d72137f676d7e09709d.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2216
  • C:\Users\Admin\AppData\Local\tpr\TpmInit.exe
    C:\Users\Admin\AppData\Local\tpr\TpmInit.exe
    1⤵
      PID:2500
    • C:\Windows\system32\TpmInit.exe
      C:\Windows\system32\TpmInit.exe
      1⤵
        PID:2616
      • C:\Windows\system32\shrpubw.exe
        C:\Windows\system32\shrpubw.exe
        1⤵
          PID:2156
        • C:\Users\Admin\AppData\Local\J6uajT5\shrpubw.exe
          C:\Users\Admin\AppData\Local\J6uajT5\shrpubw.exe
          1⤵
            PID:2228
          • C:\Windows\system32\dpapimig.exe
            C:\Windows\system32\dpapimig.exe
            1⤵
              PID:2756
            • C:\Users\Admin\AppData\Local\wYvObBc\dpapimig.exe
              C:\Users\Admin\AppData\Local\wYvObBc\dpapimig.exe
              1⤵
                PID:2248

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1400-31-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-12-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-143-0x0000000076EB6000-0x0000000076EB7000-memory.dmp

                Filesize

                4KB

              • memory/1400-5-0x0000000002E60000-0x0000000002E61000-memory.dmp

                Filesize

                4KB

              • memory/1400-30-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-19-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-24-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-29-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-34-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-36-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-38-0x0000000002E40000-0x0000000002E47000-memory.dmp

                Filesize

                28KB

              • memory/1400-46-0x00000000770C1000-0x00000000770C2000-memory.dmp

                Filesize

                4KB

              • memory/1400-50-0x0000000077220000-0x0000000077222000-memory.dmp

                Filesize

                8KB

              • memory/1400-56-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-45-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-28-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-65-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-7-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-9-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-10-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-37-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-35-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-33-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-32-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-4-0x0000000076EB6000-0x0000000076EB7000-memory.dmp

                Filesize

                4KB

              • memory/1400-11-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-62-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-27-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-26-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-25-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-23-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-22-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-21-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-20-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-18-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-13-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-14-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-17-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-16-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/1400-15-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/2216-0-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/2216-8-0x0000000140000000-0x0000000140280000-memory.dmp

                Filesize

                2.5MB

              • memory/2216-1-0x0000000000110000-0x0000000000117000-memory.dmp

                Filesize

                28KB

              • memory/2228-100-0x00000000002B0000-0x00000000002B7000-memory.dmp

                Filesize

                28KB

              • memory/2228-103-0x0000000140000000-0x0000000140281000-memory.dmp

                Filesize

                2.5MB

              • memory/2248-122-0x0000000000100000-0x0000000000107000-memory.dmp

                Filesize

                28KB

              • memory/2248-123-0x0000000140000000-0x00000001402B4000-memory.dmp

                Filesize

                2.7MB

              • memory/2500-76-0x0000000000120000-0x0000000000127000-memory.dmp

                Filesize

                28KB

              • memory/2500-79-0x0000000140000000-0x0000000140281000-memory.dmp

                Filesize

                2.5MB

              • memory/2500-74-0x0000000140000000-0x0000000140281000-memory.dmp

                Filesize

                2.5MB