Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2024 03:30

General

  • Target

    69602855143bf25085262765aa2cd991.dll

  • Size

    1.7MB

  • MD5

    69602855143bf25085262765aa2cd991

  • SHA1

    0d84b772f3bb26d79fb722330554563a667b4c04

  • SHA256

    14c81cca53cfefe7eaaad66283b38b081c7e31c5bda2f3f0e0386f68f1d6c216

  • SHA512

    b4801df13a886b77038eae6b4472dc8e4665c3cd2a3ada39e9bd25c921d0832ba76fcb68ede443c9cce5199225d09bcd173341629b1bb6ed810c708b22f8a912

  • SSDEEP

    12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\69602855143bf25085262765aa2cd991.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1940
  • C:\Windows\system32\wbengine.exe
    C:\Windows\system32\wbengine.exe
    1⤵
      PID:2292
    • C:\Users\Admin\AppData\Local\lTs00iZw\wbengine.exe
      C:\Users\Admin\AppData\Local\lTs00iZw\wbengine.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2604
    • C:\Users\Admin\AppData\Local\Pft\consent.exe
      C:\Users\Admin\AppData\Local\Pft\consent.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2008
    • C:\Windows\system32\consent.exe
      C:\Windows\system32\consent.exe
      1⤵
        PID:2752
      • C:\Users\Admin\AppData\Local\vaHG\PresentationSettings.exe
        C:\Users\Admin\AppData\Local\vaHG\PresentationSettings.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2140
      • C:\Windows\system32\PresentationSettings.exe
        C:\Windows\system32\PresentationSettings.exe
        1⤵
          PID:2136

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Pft\WTSAPI32.dll

          Filesize

          457KB

          MD5

          de793ecfebf3134cb30854751f14049d

          SHA1

          0a994e261d8f2f1919f4849c63a6bd68baa3bb11

          SHA256

          9cda479bb5867caeaceac15ec22dc6c1afc57fae7ec9dce0ef69b3733440a226

          SHA512

          9e6c27a81b155f0c40237c4915e2ea6b25ccbd8ce9efa06761de7c68c09e2933d30ee1895e1bf18919ef589bedb2084e95bc5889180e116a8364ee33b9f96b82

        • C:\Users\Admin\AppData\Local\Pft\consent.exe

          Filesize

          109KB

          MD5

          0b5511674394666e9d221f8681b2c2e6

          SHA1

          6e4e720dfc424a12383f0b8194e4477e3bc346dc

          SHA256

          ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

          SHA512

          00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

        • C:\Users\Admin\AppData\Local\lTs00iZw\XmlLite.dll

          Filesize

          149KB

          MD5

          c222dfca16df96d9dbd2b37c2f090eec

          SHA1

          13a18827d0dadb644d5052450a6e284b6222253b

          SHA256

          3081ad0b27ed1c87c548436842134d641077d0bb57358f75a05a1b2711b3a309

          SHA512

          e6c9dd7eb4ff41bd967802e8dc1caf04f74a11c40ebf2afaf94e0f2f858ae98e82d0deb5e87b40c9eb8df1d4c1a26cb29ce728796274dc5a6c976ffd65952b0f

        • C:\Users\Admin\AppData\Local\lTs00iZw\wbengine.exe

          Filesize

          285KB

          MD5

          90b0b571ed73aec49271dca4bb9fddec

          SHA1

          59322db363f47b2369c6d6315018ff2e8a4535a3

          SHA256

          d818199ff812108644d9fe7adec3e65dbd028dd00a48a3d16fd247ac0fba3fd9

          SHA512

          bcdf3aca7693cc71a1298ca683e71edd71b2418306f948f3a13995854d03296e28b0278b03988fb92df64f517b79a38e830d10f6f153fe02434bcfd4b4e20469

        • C:\Users\Admin\AppData\Local\lTs00iZw\wbengine.exe

          Filesize

          118KB

          MD5

          c14e2e2a14c31d16b728b1e74fd670e1

          SHA1

          0cf65ad861cf96b2c92182f418fe2dabecfacb85

          SHA256

          224bcf9315bdc7e5b0c0da13b485692aec21ae17d68bd7f3e5c3692d272eac93

          SHA512

          0a4eb749e13a0a6ac49889b337136da949e2b6a00452fe45b90167ce60998907b8525634a3004c6f792a05494a790ee127a2ca13cbb53a888feb5264ffd36184

        • C:\Users\Admin\AppData\Local\vaHG\PresentationSettings.exe

          Filesize

          172KB

          MD5

          a6f8d318f6041334889481b472000081

          SHA1

          b8cf08ec17b30c8811f2514246fcdff62731dd58

          SHA256

          208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258

          SHA512

          60f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69

        • C:\Users\Admin\AppData\Local\vaHG\PresentationSettings.exe

          Filesize

          29KB

          MD5

          3f683d4d5672f3faba37eca24845d161

          SHA1

          b7b38cd750a253b2a9faa15251107b99c1c972c4

          SHA256

          f5d4919e83f63f7c0f3580e93b99088800a01b960d8ddc799aea70105a3edaea

          SHA512

          5dbb651b8511ffb6f3ea98faf60d6cd43c82d826d6f08126823828034cc45a5bb2e8d0a83ac44c27aeec0a57fed373f8cff895b7aae86f675181a5bafbfd115c

        • C:\Users\Admin\AppData\Local\vaHG\WINMM.dll

          Filesize

          119KB

          MD5

          ccfd429ca3005cf9cd36dd624041e723

          SHA1

          d2bbf8d30bac51715f1abb8febe88d45505993aa

          SHA256

          eef34e76813816c6e943a7dbb5d1d2e88c09d7c2264ffee1cfb13f6b74eb1519

          SHA512

          7eea10c0ad6b45cdff2ba8409d13d99565383cce6790a7b2b11e6e59bed4c66a2554452dff0e757b670ef3a2617cbe75be5acd24d3005cc21965c10f70a900ad

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tiizeasb.lnk

          Filesize

          1KB

          MD5

          51d79a6710733ea51904f935a9c1c806

          SHA1

          4894210655499ae9b1bb96e0a88427ff8b4be195

          SHA256

          b7ec7eecf8072770def8cbae00e6cacaf67cf1ee13a225412733f0ef11df2484

          SHA512

          ac1384c1e430aa923d20a92d51169da015c4e65e9cd7e0e30658f71bac8891d39205d1b3558ea3c875f940b6ef1be8d595d58e2581a2cd07f42cc2ab9cf89bb1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\02csxhV5MJI\WINMM.dll

          Filesize

          1.7MB

          MD5

          e3ada2a571cae3ea7051aad7a760fb1b

          SHA1

          28024a3bef8a167a5d1d071de7d4115da1e85976

          SHA256

          34f5f22c44efb87d79f6bec8ab1fe2911f2dcc8930262c7b0f52490a63d1ce7b

          SHA512

          3b6aca4fadf0aaa55f947290237a8d53f6faa54b708d605f5288f26f6d66cf4461b858f1d11efb68a99b21b26f5cadd53f3e14aa00a9e8676428f68a56339a9a

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\re5Aa\WTSAPI32.dll

          Filesize

          1.7MB

          MD5

          7718b3192329489add3592629d195bd5

          SHA1

          e35c92cf96a71c39a8fc5f6902746baa3854f890

          SHA256

          cdc6e61aceedbbbd9b36f62ae851bc921c37b93e992a1fd2d27afa9c107d3c6f

          SHA512

          120fbc64f181a693e564b768bd22fce163c4b8834e2c86a1848091e33b1b375a41f1660470ebded8c2d665246d2a03d450d51e11b4c98e0cff013b5e5f80fa06

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\SmlmOHTivqg\XmlLite.dll

          Filesize

          1.7MB

          MD5

          faefe20267490a71cb73415e32b71da7

          SHA1

          84fb53c7c106677a72bf52323e4f70e57166f505

          SHA256

          edf2c2648783c2060e249cd6c4497c3604c1afa2c3865e3b08cbb1e94762a708

          SHA512

          adf8e4f6e617c16b2f0bdbdc0e1b5cda8c5b2904e25c8fa7aa4b5eff3c23d606aa22680d542a6ed3bf72f353cdf9056b626f6d6f676ad7e4b554ee789c16dd5b

        • \Users\Admin\AppData\Local\Pft\WTSAPI32.dll

          Filesize

          297KB

          MD5

          fe140709d168f6df98547e1d31946b1d

          SHA1

          99297cf10d813dfd3f7c066dc6bfc5ccbe76c1c3

          SHA256

          779a50583ea637da2cf4b485cc4ce6304a0067909b9dca1c5b5ffea6d3cf4012

          SHA512

          7fb0e313be8b2050d28be7c59714ea0ecb1a065d19c1529335a4e1eca4d87f722365d031f0bed580f492ae49ab0d8066c026e76761f7c4e4435835b09bc5986c

        • \Users\Admin\AppData\Local\lTs00iZw\XmlLite.dll

          Filesize

          195KB

          MD5

          2766d208c99ff5f47554c773c6668c05

          SHA1

          db4febeb9e254f1e1c8f464454e6b2f8a69d80f3

          SHA256

          c846f8df7a804faef01fb1f61f98859c0b9867cf43a6af3a6730659a596cebec

          SHA512

          04054780b52dbce46f3dfab10abe701efa0659972212502cf718f414ae774cd5fd5d003ee088d5c95affc114a90cc3a93998ec4bf984eb516a1cc633c8d47ab2

        • \Users\Admin\AppData\Local\lTs00iZw\wbengine.exe

          Filesize

          199KB

          MD5

          a826e27365f3b8d4fd3c380b4b38fc9a

          SHA1

          9919d60c56f21247cdef3965646e068e55a19de1

          SHA256

          9f9fd60693cb31d1c68f7e5f6ba48a56034e309465216e21fd98b9334760cf8f

          SHA512

          8d1018cbda66c7c81a7c2fe12e7e0d1f378872e55c70522933f608b3a535604b8c034811a2ea75eb4704c443e153d04d5c186f78d87f0a056ca2c209e2e0b459

        • \Users\Admin\AppData\Local\vaHG\WINMM.dll

          Filesize

          147KB

          MD5

          26d28fdf51c9e067e818a7951b02e386

          SHA1

          4746575fffe1acabcd5e4af9219c425ba83c6ad5

          SHA256

          9f17625d96c538bed5cb4242eb06866b3af5827a979ff91a4de476eac1515309

          SHA512

          3adf7c5b37715a18a1a1a9ec67a99fb2c13daa9b538f117edf19a6119ac6b3ca762bb38ff71f4242183281a4fb4bb93f03c67546d4f56de9bc3f243f26ef6ec3

        • memory/1144-24-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-52-0x0000000077820000-0x0000000077822000-memory.dmp

          Filesize

          8KB

        • memory/1144-23-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-28-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-32-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-33-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-31-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-30-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-29-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-27-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-26-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-25-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-22-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-19-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-7-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-37-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-41-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-40-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-43-0x0000000002DF0000-0x0000000002DF7000-memory.dmp

          Filesize

          28KB

        • memory/1144-42-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-39-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-38-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-36-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-35-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-34-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-4-0x00000000775B6000-0x00000000775B7000-memory.dmp

          Filesize

          4KB

        • memory/1144-51-0x00000000776C1000-0x00000000776C2000-memory.dmp

          Filesize

          4KB

        • memory/1144-50-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-61-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-67-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-20-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-5-0x0000000002E10000-0x0000000002E11000-memory.dmp

          Filesize

          4KB

        • memory/1144-146-0x00000000775B6000-0x00000000775B7000-memory.dmp

          Filesize

          4KB

        • memory/1144-14-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-21-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-17-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-18-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-13-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-9-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-12-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-10-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-11-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-16-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1144-15-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1940-8-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1940-1-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1940-0-0x0000000000310000-0x0000000000317000-memory.dmp

          Filesize

          28KB

        • memory/2008-103-0x0000000000380000-0x0000000000387000-memory.dmp

          Filesize

          28KB

        • memory/2140-123-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/2604-80-0x0000000140000000-0x00000001401BE000-memory.dmp

          Filesize

          1.7MB

        • memory/2604-84-0x0000000140000000-0x00000001401BE000-memory.dmp

          Filesize

          1.7MB

        • memory/2604-79-0x0000000000090000-0x0000000000097000-memory.dmp

          Filesize

          28KB