Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 07:50

General

  • Target

    6714db2df8a6f6b5c50d59629ec34c6c.dll

  • Size

    3.2MB

  • MD5

    6714db2df8a6f6b5c50d59629ec34c6c

  • SHA1

    a4b2879a300b905a63dce5114092208d4d1dec9a

  • SHA256

    d86ef2b5b3a29c907febf6d15d8f3fa781e1d5314549fed66df51d00db694818

  • SHA512

    7b6f0a5a4ea204821d3e513cb9a5c2926f06ab2ae2aea9d5baba857ec82867bf912edf75ab8e0250364ca81e015114d71b3e26dc9918ee734103fbc7456d1d56

  • SSDEEP

    12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6714db2df8a6f6b5c50d59629ec34c6c.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:800
  • C:\Windows\system32\cmstp.exe
    C:\Windows\system32\cmstp.exe
    1⤵
      PID:4436
    • C:\Users\Admin\AppData\Local\DbMLLK\cmstp.exe
      C:\Users\Admin\AppData\Local\DbMLLK\cmstp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4864
    • C:\Windows\system32\sppsvc.exe
      C:\Windows\system32\sppsvc.exe
      1⤵
        PID:1000
      • C:\Users\Admin\AppData\Local\Gkdmb\sppsvc.exe
        C:\Users\Admin\AppData\Local\Gkdmb\sppsvc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:560
      • C:\Windows\system32\SnippingTool.exe
        C:\Windows\system32\SnippingTool.exe
        1⤵
          PID:2848
        • C:\Users\Admin\AppData\Local\vOm174L7s\SnippingTool.exe
          C:\Users\Admin\AppData\Local\vOm174L7s\SnippingTool.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2228
        • C:\Windows\system32\RdpSaUacHelper.exe
          C:\Windows\system32\RdpSaUacHelper.exe
          1⤵
            PID:2776
          • C:\Users\Admin\AppData\Local\q25ZD\RdpSaUacHelper.exe
            C:\Users\Admin\AppData\Local\q25ZD\RdpSaUacHelper.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:4848

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\DbMLLK\VERSION.dll

            Filesize

            233KB

            MD5

            b485bc2c938b7ef3b7d634563eb26eba

            SHA1

            44d826673d5736b0c92ef9d6eca9d12d4a6b3aa1

            SHA256

            d1ea149e973d18c97de7ce48b4775f09ada300235189150c0af99ad71aa32bbc

            SHA512

            f47c8039023206cc43ba105cc83eafb30435ed5823165be2040eb39666627289bc21fde9423bf188b61fb473fcd0feb112fa56f41ffa15e20c5f70acfbd2fc73

          • C:\Users\Admin\AppData\Local\DbMLLK\VERSION.dll

            Filesize

            129KB

            MD5

            aac63ed7382e87e3796b8b38cd27658d

            SHA1

            a779b1c352d959c1fbac59a5bcce47df68619b61

            SHA256

            d79ba099bcef2fa569d032f00e84739400ef66e9bdb96a08eab4dcb61f5405c5

            SHA512

            6e54bbce3f136e673687d1ecc20c22b0a3e559155f80c719a28cc59c0015960b317f911819a582087ccb5d4729cf543c82b54b6ed42d2456d42559e2597e1379

          • C:\Users\Admin\AppData\Local\DbMLLK\VERSION.dll

            Filesize

            125KB

            MD5

            8d12cc5ebd1dc117c2350334c64e51a6

            SHA1

            3eff9980a31999a3a34185a93f142226f3086b27

            SHA256

            fe9523e6386913d82d6c2803ce6539ea50bb6bee898ac595e9a0a7e4395e7ff6

            SHA512

            2806dfb03c560edb48a11e5b7896088542215efdc5b5496f9188ccd5f95f357bf66cf85b876d0e453d47a7a13cc59297b8ad08ffb7ae33cb31bbb9acec049a2a

          • C:\Users\Admin\AppData\Local\DbMLLK\cmstp.exe

            Filesize

            38KB

            MD5

            121dfc2fe6f6a84b06eb0d6f0dbc2c8e

            SHA1

            7e322b5a7003dd7370c330a4179f91bd50d4b07a

            SHA256

            2651ec3fa204d1ff89595fba5dbd8b1565cb32bf0b4e91623202f2d8097bbe09

            SHA512

            c5b9c4b641d8486c8e6e65c047d8292f5a44bc9341bae65b2588f4b5694ce5495feb54ff11ec5b58ebb4d9cf2aaecab586ebf0bc58bf6b9161d17b1b9db58f59

          • C:\Users\Admin\AppData\Local\DbMLLK\cmstp.exe

            Filesize

            96KB

            MD5

            4cc43fe4d397ff79fa69f397e016df52

            SHA1

            8fd6cf81ad40c9b123cd75611860a8b95c72869c

            SHA256

            f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c

            SHA512

            851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157

          • C:\Users\Admin\AppData\Local\Gkdmb\XmlLite.dll

            Filesize

            7KB

            MD5

            75fef8ec2da7e712ea0b8c3d60af413f

            SHA1

            a52255558de36a60d022ea5af621320bfee36d83

            SHA256

            1444f5be0608bab20c0302d860f81aad105ef22fd4afdf722577cef9c1aa0221

            SHA512

            c5f207f9dba1c010f00652bf0c10d2942aaadea10ccdb114d6ac4c612cdc13e098d13c0b189a23f24a7a3d4e8a3f02ba3cd3fa73c499dd95de1caa79c19c8af0

          • C:\Users\Admin\AppData\Local\Gkdmb\XmlLite.dll

            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • C:\Users\Admin\AppData\Local\Gkdmb\sppsvc.exe

            Filesize

            68KB

            MD5

            76522df15475f02bf7dc0aa202f4c9de

            SHA1

            3ec68f95f83365e73f4a85f1cf97787ce6e75eef

            SHA256

            5125f542dd7dbda0c2ea920d9e4090ded59cdcfd29e87e28a9dae7554089bcf9

            SHA512

            0aad23389328c3cb5f77e93834f0cfcb0666282fafe56db935146a606da63b27d748757ac34be865c328fa2103dc60389017c4f3a88bb61e791e8014e33604b1

          • C:\Users\Admin\AppData\Local\q25ZD\RdpSaUacHelper.exe

            Filesize

            33KB

            MD5

            0d5b016ac7e7b6257c069e8bb40845de

            SHA1

            5282f30e90cbd1be8da95b73bc1b6a7d041e43c2

            SHA256

            6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067

            SHA512

            cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e

          • C:\Users\Admin\AppData\Local\q25ZD\WINSTA.dll

            Filesize

            137KB

            MD5

            87f3487d9b3609ee8d85309b202eba23

            SHA1

            fad9cb70114f31a30b82a3941b9aeebf8b9e0ab5

            SHA256

            aaa3ec4df10df7c46ede712624eb3ba8289e4548226a59bb28f9608a409b87ac

            SHA512

            9586b528dcc2c91dd2149dbb426280f825b50c6ecd21c9f578aafb9097f94ab23e7b09d32276ecf0bf5c75e8726d88b74e9e72b6aaeccbc2391379eb13b8edd0

          • C:\Users\Admin\AppData\Local\q25ZD\WINSTA.dll

            Filesize

            128KB

            MD5

            276eb57200c0063186402a4304451536

            SHA1

            f78ec17fcb7a398ab1bd31a86af18a416665e4e6

            SHA256

            17ffe57e068eacabc091356a90c75dbf10a60fffaa8e37177adcd425be6257b5

            SHA512

            7e71b25f20fad100206a2132dbd0e03accaaabd40b53878fc7b32a862dbbc62c692234be78f2ffa93fd591a471d1a479bf23170ad5ffa80ba61e6c65cab3dd9b

          • C:\Users\Admin\AppData\Local\vOm174L7s\SnippingTool.exe

            Filesize

            68KB

            MD5

            6ececee18c82ad304b1d06b10208d2ff

            SHA1

            56988e12e06fab7cc3a1baab7d78979c2dc8d290

            SHA256

            fb2200e5ed55b7f2f2324ce5656dd73f589c4dfd5ff568776825e7bc81a6595e

            SHA512

            1a951a7971619537dbf26dc35cb6524986fce572850fa0ef117e0ac4f91e6b642a0027adf29979e98ef2380e6d201a06cc410565a8db34c482e0f3e11311a90f

          • C:\Users\Admin\AppData\Local\vOm174L7s\UxTheme.dll

            Filesize

            90KB

            MD5

            a9cd11bed2c07f798caedf4cc013acb4

            SHA1

            c115955839c6b4f52deedeecd5ce45b1d640de12

            SHA256

            eaa2de2fc193015e81ac575cd06fb082b1db4331456b26ae5fcbe66147c290bd

            SHA512

            bade396ddbbc49f363761d4adb96c474290963721ff113a6d25e980602425557345a3fa10e2229fa6f3de5e5e81d0fd9f856a36868db1ecd9b0716fdcca655b1

          • C:\Users\Admin\AppData\Local\vOm174L7s\UxTheme.dll

            Filesize

            57KB

            MD5

            047fb5fba00720f7c8d0e86f3f48a04d

            SHA1

            da35002a111a7f4a6492ca3635187b9f1de80bdc

            SHA256

            359d6a91ed1ec5722202458f04c50592a64ad2ff10378c961a46e53d34f6072a

            SHA512

            394c0bf917725063ff1c160f4335b1d9ee8b18838b14a0fe1a43f05b016930e6cb04fe26120fb605ab9ca0242a5345acf429a7ba8712c06f6d0dbfc9e58cbb1b

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Udjzqp.lnk

            Filesize

            1KB

            MD5

            9b4f8d1a23abf25112971055d616d32a

            SHA1

            34b759178210de08deed06055eb0989224997872

            SHA256

            33021467e2df029a97a6f2db4f45ef9f0fcb146052cfd4b0fde1a09f63a79289

            SHA512

            31677224c0b088f91c03daedb2303644e425c0c0c0528521510e2fd08ce01876c9568cbf5d62f6fe19443222e57d75e927024c9f35b3a1bbb27126619c0475f5

          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\fO\WINSTA.dll

            Filesize

            258KB

            MD5

            85a51b315a1959ac8a2bb1814a53bbe5

            SHA1

            9da4c3ec46b1fb5858113650564e826038bf0500

            SHA256

            135c94d666f3cd4b401cf35d43680713f689c4eef286bee3cbd81478cac4e39d

            SHA512

            3a44cd1736d26e0bf3707be3ec3a123bbc849f6576c8e70a50949c8c892896fcef38937de3e2c9d0083f03e18e2bbadfa3559336a64f399486e7d3b541cca5ee

          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ymOch4b3\VERSION.dll

            Filesize

            73KB

            MD5

            6428df938670ba9ba8e8f3b7e5e4afbd

            SHA1

            3a9c3cfdf58aac25e9ab7edcc5a8d9120ccdf6c6

            SHA256

            3b24bc5c24dcb54d77de8156f5ba38ca71c50b5fcd72d39c76064d536fe06521

            SHA512

            191d1bd87d81039e031b9ea7c2f5a1ec492b3a2b384ff2509fcdaaf51f86f3e821bd51d947974c924b339910df73b6d3d35c6a645c2b5d2bd724ed1c9321ea87

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\4J4NzkY\XmlLite.dll

            Filesize

            347KB

            MD5

            b4561c365bf82b197da05111c811ff56

            SHA1

            057ba2ca7045af2e900fb32fa43876855dad7515

            SHA256

            dab1ebd0f5ff1202c3c2a4a755f6b04f0cce18340a618435f15ffee8fdf4ac22

            SHA512

            9aba6501d0023f100a3cf38a44cf468bc139a57b19593b61788e03d191f4f14db35efe73a2214797b272e2a4ea4c05d249bf0784dce24204bb91d389c7e9eb80

          • memory/560-112-0x000001F7D1DD0000-0x000001F7D1DD7000-memory.dmp

            Filesize

            28KB

          • memory/800-8-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/800-1-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/800-0-0x0000023F663B0000-0x0000023F663B7000-memory.dmp

            Filesize

            28KB

          • memory/3412-41-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-48-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-23-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-24-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-25-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-26-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-27-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-29-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-31-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-34-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-35-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-37-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-36-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-33-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-32-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-30-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-38-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-39-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-40-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-28-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-21-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-42-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-43-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-45-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-44-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-47-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-50-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-52-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-53-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-51-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-49-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-22-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-46-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-54-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-55-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-57-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-56-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-58-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-61-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-63-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-64-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-65-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-66-0x0000000002FD0000-0x0000000002FD7000-memory.dmp

            Filesize

            28KB

          • memory/3412-62-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-60-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-59-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-20-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-19-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-18-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-17-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-16-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-15-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-14-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-13-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-12-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-11-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-74-0x00007FFA972E0000-0x00007FFA972F0000-memory.dmp

            Filesize

            64KB

          • memory/3412-5-0x00007FFA9554A000-0x00007FFA9554B000-memory.dmp

            Filesize

            4KB

          • memory/3412-7-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-10-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-9-0x0000000140000000-0x0000000140331000-memory.dmp

            Filesize

            3.2MB

          • memory/3412-4-0x00000000078D0000-0x00000000078D1000-memory.dmp

            Filesize

            4KB

          • memory/4848-139-0x000001E42E9A0000-0x000001E42E9A7000-memory.dmp

            Filesize

            28KB

          • memory/4864-95-0x00000134D43F0000-0x00000134D43F7000-memory.dmp

            Filesize

            28KB