Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 19:20

General

  • Target

    686ead54f11ad7a199730fa54bd87917.dll

  • Size

    3.5MB

  • MD5

    686ead54f11ad7a199730fa54bd87917

  • SHA1

    c45300b31ef01134e50004809d5e945c10ef6f21

  • SHA256

    157dba446a7b409cd3c0b7b59b764fde1820a4c8c7431a2ea28e841ec9ea5056

  • SHA512

    46cb02ef280e20b25201edb1d7fb0ab7752ea573c492e23c49421a931a60bd8ab700cd5fe851bbf71232cbe3627ac903a6133aaccd53111b8f8cc4d06caf2e39

  • SSDEEP

    12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\686ead54f11ad7a199730fa54bd87917.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4332
  • C:\Windows\system32\mspaint.exe
    C:\Windows\system32\mspaint.exe
    1⤵
      PID:3000
    • C:\Users\Admin\AppData\Local\raRvDY1c\mspaint.exe
      C:\Users\Admin\AppData\Local\raRvDY1c\mspaint.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4288
    • C:\Windows\system32\sessionmsg.exe
      C:\Windows\system32\sessionmsg.exe
      1⤵
        PID:3636
      • C:\Users\Admin\AppData\Local\APG\sessionmsg.exe
        C:\Users\Admin\AppData\Local\APG\sessionmsg.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3932
      • C:\Windows\system32\lpksetup.exe
        C:\Windows\system32\lpksetup.exe
        1⤵
          PID:1644
        • C:\Users\Admin\AppData\Local\ACqx4XaS\lpksetup.exe
          C:\Users\Admin\AppData\Local\ACqx4XaS\lpksetup.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3692

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\ACqx4XaS\dpx.dll

          Filesize

          3.5MB

          MD5

          f39d4b64ad8035f15eb7c25e6ee41449

          SHA1

          32e6178d819a25d88a6b46ebcf36118dd08e8834

          SHA256

          65ae0849104a1c8f19589cc0bb34c9567358a7d64c69020f0874a8bc5c29de35

          SHA512

          c467fd4539c8964e8fd6c2fd394d28c345d8a8ac60616c6eb52671afbcddb6744e660056d5152a27b2c840c0d6a442b99b24e3c0d2c9b4aa17b88fed183dae6d

        • C:\Users\Admin\AppData\Local\ACqx4XaS\lpksetup.exe

          Filesize

          728KB

          MD5

          c75516a32e0aea02a184074d55d1a997

          SHA1

          f9396946c078f8b0f28e3a6e21a97eeece31d13f

          SHA256

          cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22

          SHA512

          92994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc

        • C:\Users\Admin\AppData\Local\APG\DUser.dll

          Filesize

          3.5MB

          MD5

          702bc27161117d7a8294c608a32534bf

          SHA1

          ef183fb21eb03fa1db51bb2ee189e381dc50fef7

          SHA256

          2efd5495fc23c28e4ecc1b127c6a47e04965a72b45cd1a50ebfab037a22ac0f7

          SHA512

          2b7b75b3c46384c6979bf2244e78f7173bd917da153f2e5d74425e7cd7a60a9ce36a3893531920dcb1e73ad7029f9cc1d9a6fe7bbca9b8a2caa5fe81c9656204

        • C:\Users\Admin\AppData\Local\APG\sessionmsg.exe

          Filesize

          85KB

          MD5

          480f710806b68dfe478ca1ec7d7e79cc

          SHA1

          b4fc97fed2dbff9c4874cb65ede7b50699db37cd

          SHA256

          2416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc

          SHA512

          29d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db

        • C:\Users\Admin\AppData\Local\raRvDY1c\MFC42u.dll

          Filesize

          3.5MB

          MD5

          5f13b4c62f85ab2c01ff5c8c6a10bca4

          SHA1

          ed1ea0ebe89c4276daef66407588b3132e6c6736

          SHA256

          1544154c1bba837590a9b9833c8a86bf4d8a2354e2e22fbfb4c650de4d232038

          SHA512

          670b41600c19a5b906da2f496d3b441412990440d607e8642b94d70e330e845d215f99366ebb319f59e85f61726c91808b70bc3842572c09f8db9a7018a5359c

        • C:\Users\Admin\AppData\Local\raRvDY1c\mspaint.exe

          Filesize

          965KB

          MD5

          f221a4ccafec690101c59f726c95b646

          SHA1

          2098e4b62eaab213cbee73ba40fe4f1b8901a782

          SHA256

          94aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709

          SHA512

          8e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          747032d2cb3d6ce256b6ab17a9317405

          SHA1

          a726ffd1ed4cd189c030641d8751adbfa4026d57

          SHA256

          12c5c86243289459ac6362ad6651f9dc0286cf64c42ecbf1f08db92ee61e10d3

          SHA512

          249e570fc2ba1abf53e0e2ab890374359bbd5bfee23cea8dfacfeda84f8707d1d85d9cb3938f850804a02c44f60a2ae558fd540379f84df3f1457a744ada30ac

        • memory/3372-45-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-60-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-15-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-17-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-18-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-8-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-49-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-19-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-20-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-22-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-23-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-21-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-24-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-25-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-26-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-48-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-28-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-29-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-30-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-31-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-32-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-33-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-34-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-35-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-36-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-37-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-38-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-39-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-40-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-41-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-42-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-43-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-44-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-5-0x00000000036C0000-0x00000000036C1000-memory.dmp

          Filesize

          4KB

        • memory/3372-46-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-47-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-27-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-10-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-14-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-51-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-52-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-53-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-54-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-55-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-56-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-57-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-58-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-59-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-61-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-50-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-62-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-63-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-64-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-65-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-66-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-67-0x0000000003210000-0x0000000003217000-memory.dmp

          Filesize

          28KB

        • memory/3372-76-0x00007FFC912E0000-0x00007FFC912F0000-memory.dmp

          Filesize

          64KB

        • memory/3372-13-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-12-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-7-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-9-0x00007FFC901AA000-0x00007FFC901AB000-memory.dmp

          Filesize

          4KB

        • memory/3372-11-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/3692-141-0x0000000140000000-0x0000000140378000-memory.dmp

          Filesize

          3.5MB

        • memory/3692-131-0x0000000140000000-0x0000000140378000-memory.dmp

          Filesize

          3.5MB

        • memory/3692-133-0x00000229771F0000-0x00000229771F7000-memory.dmp

          Filesize

          28KB

        • memory/3932-115-0x000001FBE2790000-0x000001FBE2797000-memory.dmp

          Filesize

          28KB

        • memory/3932-120-0x0000000140000000-0x0000000140379000-memory.dmp

          Filesize

          3.5MB

        • memory/3932-114-0x0000000140000000-0x0000000140379000-memory.dmp

          Filesize

          3.5MB

        • memory/4288-103-0x0000000140000000-0x000000014037E000-memory.dmp

          Filesize

          3.5MB

        • memory/4288-98-0x0000000140000000-0x000000014037E000-memory.dmp

          Filesize

          3.5MB

        • memory/4288-100-0x000002ABDF7F0000-0x000002ABDF7F7000-memory.dmp

          Filesize

          28KB

        • memory/4332-1-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/4332-0-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB

        • memory/4332-3-0x000001AD911A0000-0x000001AD911A7000-memory.dmp

          Filesize

          28KB

        • memory/4332-16-0x0000000140000000-0x0000000140377000-memory.dmp

          Filesize

          3.5MB