Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-01-2024 19:20

General

  • Target

    686ead54f11ad7a199730fa54bd87917.dll

  • Size

    3.5MB

  • MD5

    686ead54f11ad7a199730fa54bd87917

  • SHA1

    c45300b31ef01134e50004809d5e945c10ef6f21

  • SHA256

    157dba446a7b409cd3c0b7b59b764fde1820a4c8c7431a2ea28e841ec9ea5056

  • SHA512

    46cb02ef280e20b25201edb1d7fb0ab7752ea573c492e23c49421a931a60bd8ab700cd5fe851bbf71232cbe3627ac903a6133aaccd53111b8f8cc4d06caf2e39

  • SSDEEP

    12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\686ead54f11ad7a199730fa54bd87917.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1912
  • C:\Windows\system32\SystemPropertiesPerformance.exe
    C:\Windows\system32\SystemPropertiesPerformance.exe
    1⤵
      PID:2588
    • C:\Users\Admin\AppData\Local\eNHG53n1G\SystemPropertiesPerformance.exe
      C:\Users\Admin\AppData\Local\eNHG53n1G\SystemPropertiesPerformance.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2732
    • C:\Windows\system32\DeviceDisplayObjectProvider.exe
      C:\Windows\system32\DeviceDisplayObjectProvider.exe
      1⤵
        PID:2044
      • C:\Users\Admin\AppData\Local\4k4ENMr\DeviceDisplayObjectProvider.exe
        C:\Users\Admin\AppData\Local\4k4ENMr\DeviceDisplayObjectProvider.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1696
      • C:\Windows\system32\dialer.exe
        C:\Windows\system32\dialer.exe
        1⤵
          PID:2440
        • C:\Users\Admin\AppData\Local\eqVDJN76\dialer.exe
          C:\Users\Admin\AppData\Local\eqVDJN76\dialer.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2972

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\4k4ENMr\XmlLite.dll

          Filesize

          3.5MB

          MD5

          a4a453776b7d07f79c3f8296c7febf72

          SHA1

          3af3ea16e71c3655ec2f59290bde9254ed9020d2

          SHA256

          62d74716443adc56f3f726c29b4d158f76876e5440d4ed9ae8e022e11f81b6b9

          SHA512

          5ffd33f18a692a327fa95b8126a55a8a5f758bc9843ce624fbb25ff63612ae8bfd8fc4fa33a759c92e53ecb6e6208120eb954e4fe9c2ed6599f54b09472cab0a

        • C:\Users\Admin\AppData\Local\eNHG53n1G\SystemPropertiesPerformance.exe

          Filesize

          80KB

          MD5

          870726cdcc241a92785572628b89cc07

          SHA1

          63d47cc4fe9beb75862add1abca1d8ae8235710a

          SHA256

          1ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6

          SHA512

          89b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72

        • C:\Users\Admin\AppData\Local\eqVDJN76\TAPI32.dll

          Filesize

          3.5MB

          MD5

          46fbb655538001d339135d4c77ee8d21

          SHA1

          c4b592a79a2a53d9aef93039118efbb1f9e57388

          SHA256

          7ff55a829b489dad5c4e9bd62b97443a9ca2c411f62b32691bb883e537f30539

          SHA512

          cf8a3197fdf7bd39e9ff7b90ff2c1c77fc29c8a009aa759058c2d08153dd3b555b35e6e56c68c80123175f1c58985f9763f1701b307a26187724c0bc110425bc

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          39311e9d44fc91675f28e1583a4cddd2

          SHA1

          7a2aabaa786e306e6c8ff8914ba49e1a682d38f0

          SHA256

          be712bfb5efe009120d00fb774abc1e8deb779466871f5139b8e7173f4aa826c

          SHA512

          b647667a47a2eec165a5195c8c91e64523e4adcd8a27ed0b3ac744a28425c16958463bd1a3e96183504654128df9b2e66a5dd6184f240af5d8b6a7cf9a40d4e2

        • \Users\Admin\AppData\Local\4k4ENMr\DeviceDisplayObjectProvider.exe

          Filesize

          109KB

          MD5

          7e2eb3a4ae11190ef4c8a9b9a9123234

          SHA1

          72e98687a8d28614e2131c300403c2822856e865

          SHA256

          8481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0

          SHA512

          18b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf

        • \Users\Admin\AppData\Local\eNHG53n1G\SYSDM.CPL

          Filesize

          3.5MB

          MD5

          a121d03a6d07fcac2b4074f19af1a147

          SHA1

          4e6f486f76833315bd56fe32e527311d100abf5e

          SHA256

          660046c1841f5e7dec979546b7fe3e1be5dabce6b4b7af6fe10b864ac03d5be4

          SHA512

          f9968942ebb5b9dafaae70f92988b0105648c956715b98fbb36ecba74e0a9172d8b8f7d66f32588cd1035f412088e0a98cb037df1ab4dc8dccc3980d55a17bc7

        • \Users\Admin\AppData\Local\eqVDJN76\dialer.exe

          Filesize

          34KB

          MD5

          46523e17ee0f6837746924eda7e9bac9

          SHA1

          d6b2a9cc6bd3588fa9804ada5197afda6a9e034b

          SHA256

          23d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382

          SHA512

          c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a

        • memory/1216-59-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-16-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-14-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-17-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-18-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-55-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-19-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-20-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-21-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-22-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-54-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-23-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-25-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-27-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-26-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-29-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-28-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-31-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-30-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-32-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-35-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-34-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-33-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-36-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-37-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-65-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-64-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-63-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-62-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-56-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-60-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-4-0x0000000077966000-0x0000000077967000-memory.dmp

          Filesize

          4KB

        • memory/1216-58-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-57-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-61-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-15-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-24-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-53-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-52-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-51-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-50-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-49-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-48-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-47-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-46-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-45-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-44-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-43-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-42-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-41-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-40-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-39-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-38-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-74-0x0000000002A50000-0x0000000002A57000-memory.dmp

          Filesize

          28KB

        • memory/1216-85-0x0000000077A71000-0x0000000077A72000-memory.dmp

          Filesize

          4KB

        • memory/1216-84-0x0000000077BD0000-0x0000000077BD2000-memory.dmp

          Filesize

          8KB

        • memory/1216-13-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-7-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-5-0x0000000002A80000-0x0000000002A81000-memory.dmp

          Filesize

          4KB

        • memory/1216-165-0x0000000077966000-0x0000000077967000-memory.dmp

          Filesize

          4KB

        • memory/1216-12-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-11-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-9-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1216-10-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1696-124-0x0000000000170000-0x0000000000177000-memory.dmp

          Filesize

          28KB

        • memory/1912-8-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/1912-0-0x0000000000330000-0x0000000000337000-memory.dmp

          Filesize

          28KB

        • memory/1912-1-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/2732-104-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2972-143-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB