Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2024 12:24

General

  • Target

    6a6b1b2cfc389798b42fa591a501875a.dll

  • Size

    4.0MB

  • MD5

    6a6b1b2cfc389798b42fa591a501875a

  • SHA1

    a0139d22265f40b8571722655d128c58f500d50b

  • SHA256

    0aecdf55017f43fa0c4a2c407c639d854fb2fddd9400e047d573b163596ef7f5

  • SHA512

    652b3db7e0e0f19e7362f08ce418290fbec37c7e66a2ee6a5b8abd644caa056d6c5c4372a35eb607d40f0f3b60847130e29dc42a945d34c5147a3a2375b11813

  • SSDEEP

    24576:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnbxXM0:qDW/e+WG0Vo6CtSn6

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6b1b2cfc389798b42fa591a501875a.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2696
  • C:\Windows\system32\msra.exe
    C:\Windows\system32\msra.exe
    1⤵
      PID:3988
    • C:\Users\Admin\AppData\Local\r3k2\msra.exe
      C:\Users\Admin\AppData\Local\r3k2\msra.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1956
    • C:\Windows\system32\mfpmp.exe
      C:\Windows\system32\mfpmp.exe
      1⤵
        PID:1728
      • C:\Users\Admin\AppData\Local\auaOx\mfpmp.exe
        C:\Users\Admin\AppData\Local\auaOx\mfpmp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4328
      • C:\Windows\system32\BitLockerWizardElev.exe
        C:\Windows\system32\BitLockerWizardElev.exe
        1⤵
          PID:4804
        • C:\Users\Admin\AppData\Local\sfsFTIoji\BitLockerWizardElev.exe
          C:\Users\Admin\AppData\Local\sfsFTIoji\BitLockerWizardElev.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:4272

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\auaOx\MFPlat.DLL

          Filesize

          28KB

          MD5

          927238ffdcadd5fe585d632ec8755962

          SHA1

          ae8b86a22949aa8973174ab5e9d9cd3dd29460ff

          SHA256

          2c5738fa5c2f46fa8f911fd65fef4287d5245145ebb535c53eef5ed5bd20ec46

          SHA512

          1debc5cd22a063dcef7d7348cd956bfa047d3ebf496ce4928a2e377018d00a486ae78fdedcb21261f3bddce115162c5360718f685b8a20b88b366aa25a0d0857

        • C:\Users\Admin\AppData\Local\auaOx\MFPlat.DLL

          Filesize

          21KB

          MD5

          cd9aca571d930d4295f7915a8f4a461b

          SHA1

          98aafc34634d74c1a07fcf3c56dabdb98c64b5b7

          SHA256

          57ccdd0297d5b773b779e376ad3305f119b25371610617f2d7bfd2642a249307

          SHA512

          ad99507fc1f390c34605919d8eab753a431328d247bcadc485762de51557c5429073e395444f870867a09107f470d847e68ee52537bfa3be052f367013e4314f

        • C:\Users\Admin\AppData\Local\auaOx\mfpmp.exe

          Filesize

          46KB

          MD5

          8f8fd1988973bac0c5244431473b96a5

          SHA1

          ce81ea37260d7cafe27612606cf044921ad1304c

          SHA256

          27287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e

          SHA512

          a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab

        • C:\Users\Admin\AppData\Local\r3k2\UxTheme.dll

          Filesize

          26KB

          MD5

          158efa34afa3ad3ecdfebb44d64bb127

          SHA1

          cd7baa1e71aed07a304a16f3e98606687343e231

          SHA256

          c26594a0522018aa15828f5f9f04a104bb6504ea3512c2a756dae0f8273cff8f

          SHA512

          a8e168b026cdaabff5f60b1581370cbcdf66138326a1a6675fa9ac11ee4ea48e8fc8620833560ce80d0f09403c0963aa70835c0e2449c5985cfffe054055df72

        • C:\Users\Admin\AppData\Local\r3k2\UxTheme.dll

          Filesize

          25KB

          MD5

          836db5aa3379da7be07bbffde22b50a1

          SHA1

          0660f2b3ee85fddf49974d4d8d8e573dedae18c9

          SHA256

          d0b618fb197f9206134900728a5908890bec2d78020ba6ddcbe2832453df909f

          SHA512

          5f3d7fb2d3d8959634426f1fe6462f91ce5d7361c1d5b22675478e2429e7eae2e7811c8c7a0583c80d11a085eafdb5134e7d8fee49c6f9bf47c4f9dc53e5b935

        • C:\Users\Admin\AppData\Local\r3k2\msra.exe

          Filesize

          57KB

          MD5

          400b880bdce2445fc113b4a5e2a2499b

          SHA1

          8eabb5b795f392e64faf5f3cb581ae0cfd701019

          SHA256

          60e3525be63b45a54e2bc10e0199fba7b603f98fb3eccba71fd0a1befcfd193d

          SHA512

          be123bc05d53de478af7c5225b0e619a07ee5edf80689847da0c75b2121334145c9c16d360a4757d303168a83335cf694207121310a999c8de1010784d0dc56d

        • C:\Users\Admin\AppData\Local\r3k2\msra.exe

          Filesize

          82KB

          MD5

          d586ea3ba1d29a5b754aea8f3f703a03

          SHA1

          929a309d54715e224198385c5e7721874837f7a1

          SHA256

          995f930c3b4310c9449e4e585a9bd718a313ed4c1aaadb3aae64cd2fb46dad7e

          SHA512

          15fc78a448e8e2bbd7de2b50f222390a985999a35df2379ec8c874f69afb33823d6b5b04e3d98cea30ba6fbc7d847d47a89e1bbe3735715b9aa531f4abbbb5de

        • C:\Users\Admin\AppData\Local\sfsFTIoji\BitLockerWizardElev.exe

          Filesize

          100KB

          MD5

          8ac5a3a20cf18ae2308c64fd707eeb81

          SHA1

          31f2f0bdc2eb3e0d2a6cd626ea8ed71262865544

          SHA256

          803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5

          SHA512

          85d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b

        • C:\Users\Admin\AppData\Local\sfsFTIoji\FVEWIZ.dll

          Filesize

          68KB

          MD5

          c875067683ede9ca8e686ab7ade73a5a

          SHA1

          716bfd7182f301731661ddb1f7503e5a113672db

          SHA256

          364902b3e3a5e974e36ba9a573c3e84fa103cc2a994b371fc34558275d1730d8

          SHA512

          873aed324231eda4e63f6659f4d23cf7c0bab0d55daa7ff9d70270b77afada347d823e3383336bb53775971229135683288d10d76398c8ae185862112c9f0d1e

        • C:\Users\Admin\AppData\Local\sfsFTIoji\FVEWIZ.dll

          Filesize

          149KB

          MD5

          07eaf9359d605cf013b20aa816c83efa

          SHA1

          2858d90d8a421ae05d03175618854f2b3619637e

          SHA256

          50c83c7a9609fe5aa74118b5626ff8918bdc163c7aab308db3f38223184664fb

          SHA512

          88292cd28ea8fa50318f4447d187ebb4735305e47bb2676bcfc33ef79441be55dfa002c48cbef56f9f43dcdde4860958e82792602d450f57336d106e728c21b1

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqwbkkvq.lnk

          Filesize

          1KB

          MD5

          856e649b8cf113ee7f060663cf12d3c5

          SHA1

          2d4419fab7652262407d243f69804e4668faf176

          SHA256

          9adff31fcdb6ca24e3912682f6c39bcfd0323b5cb2183f726f667b79ac59fcd6

          SHA512

          7208aacb2ac49d19fd0a8156d6395aaaf2c580d1cd3d6fd98cab4beaa8ca9cd4bf1cb6711d01b0640008670f7c2a65584f668b00ce296a52590a47040daa72b8

        • C:\Users\Admin\AppData\Roaming\Microsoft\Proof\VU6ip3zKf\MFPlat.DLL

          Filesize

          47KB

          MD5

          f208ef34299c376b1c1c84948f84594c

          SHA1

          53ead9ade4f3cacf12e7dcfef0a058c0d35dd12a

          SHA256

          6b2a5b41e7e1d761cfd5afb83987ef3722a65483b8387b19b5c8a5163dd5cbb9

          SHA512

          b409a0b2ea64cd7e823c0e33c3919906be9bca34152484c0ded645f5b35be351b69983039ad27db90f8fe0bef74a2de08cf2cc849c803aca006b2785d88b30de

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\updCasWY\UxTheme.dll

          Filesize

          190KB

          MD5

          6e23852bae62ddb9fd140ba5c6daa4aa

          SHA1

          53d9c7d5fccab9d287ae1d3b14a88349e852c0ff

          SHA256

          ad69d03399366c65b3018550e04253c45df83e6efede52852ef947e96dcf31ff

          SHA512

          f85dfe8b330ae060e2805ad84a5879484467ef56f04b19c6b1f56b2f6fb0bfe486d77a4c490459c6b28c71f72cba2924418d2fcb16a9a8fded283ebc3fdc2f7a

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OYQ\FVEWIZ.dll

          Filesize

          57KB

          MD5

          268e624df6d702c3d938b7700fa4dcf1

          SHA1

          4dcd869857ea211dab357378fa9d7c3494d45a7b

          SHA256

          40a2798e5b5f70c8f97bd5a40f19a70b7c1067578106b2049c592816ec08372e

          SHA512

          fe67afc73520959b4040d1056373e2b4f82e12a7d5d3792f3987cbb26eed9758338d46f31c06ded1e3cf75ea4b9d648dec2a59d4a5e31c3c359cd608b9193043

        • memory/1956-97-0x000002A3B4FF0000-0x000002A3B4FF7000-memory.dmp

          Filesize

          28KB

        • memory/2696-7-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/2696-0-0x0000028E3D9F0000-0x0000028E3D9F7000-memory.dmp

          Filesize

          28KB

        • memory/2696-1-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-36-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-55-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-21-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-22-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-23-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-17-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-24-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-25-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-26-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-28-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-29-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-27-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-30-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-31-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-32-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-14-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-33-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-34-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-38-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-39-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-37-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-40-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-19-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-35-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-43-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-45-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-46-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-48-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-47-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-51-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-53-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-20-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-56-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-58-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-59-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-60-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-62-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-63-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-64-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-65-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-61-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-57-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-54-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-52-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-50-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-49-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-44-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-18-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-16-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-42-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-41-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-70-0x0000000001220000-0x0000000001227000-memory.dmp

          Filesize

          28KB

        • memory/3528-77-0x00007FF95A700000-0x00007FF95A710000-memory.dmp

          Filesize

          64KB

        • memory/3528-5-0x00007FF95885A000-0x00007FF95885B000-memory.dmp

          Filesize

          4KB

        • memory/3528-15-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-11-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-4-0x0000000007F50000-0x0000000007F51000-memory.dmp

          Filesize

          4KB

        • memory/3528-13-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-10-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-12-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-9-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/3528-8-0x0000000140000000-0x0000000140403000-memory.dmp

          Filesize

          4.0MB

        • memory/4272-132-0x000001901B8F0000-0x000001901B8F7000-memory.dmp

          Filesize

          28KB

        • memory/4328-115-0x000001FBF0AA0000-0x000001FBF0AA7000-memory.dmp

          Filesize

          28KB