Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2024 16:15

General

  • Target

    6ae01647123bf97071130c123fe77e97.dll

  • Size

    1.6MB

  • MD5

    6ae01647123bf97071130c123fe77e97

  • SHA1

    b60d8943baf640b7bbc58e9f3639db832e430d2f

  • SHA256

    2432a727b7612212c6c75b5114e832254e05720df6fd9d38b7993973e74efd9f

  • SHA512

    79c82da530496865a77cd0bce988fe1e9e6b85ea71a951b478fbac3ff45ff86fe30c7aac23c5bcb33932e8ac9ff94899f33a40233fdaaf32b45ec66efdacc9c2

  • SSDEEP

    12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ae01647123bf97071130c123fe77e97.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3460
  • C:\Windows\system32\DWWIN.EXE
    C:\Windows\system32\DWWIN.EXE
    1⤵
      PID:5012
    • C:\Users\Admin\AppData\Local\BwMpPT\DWWIN.EXE
      C:\Users\Admin\AppData\Local\BwMpPT\DWWIN.EXE
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:5108
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe
      1⤵
        PID:4552
      • C:\Users\Admin\AppData\Local\3KR2I7E\mmc.exe
        C:\Users\Admin\AppData\Local\3KR2I7E\mmc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:412
      • C:\Windows\system32\AtBroker.exe
        C:\Windows\system32\AtBroker.exe
        1⤵
          PID:2144
        • C:\Users\Admin\AppData\Local\XYO\AtBroker.exe
          C:\Users\Admin\AppData\Local\XYO\AtBroker.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:4268

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\3KR2I7E\MFC42u.dll

          Filesize

          1.3MB

          MD5

          79356d312d8d82f29775db59d6b3f0f3

          SHA1

          af939287a3b83078d20c3a76624b61b77d01f7c2

          SHA256

          8d2c77ac85ae39384819db2caff342c55089445b5686dd18afdcd08e4171b324

          SHA512

          79903fdca6f3163a87d10398b591209c0d47f3faf727aafd12d76a63eb5b632640b6e3eed7ccff5f0e85e8b8ab5c8f9f848652a6d04253817bad0709fedf58c4

        • C:\Users\Admin\AppData\Local\3KR2I7E\MFC42u.dll

          Filesize

          1.6MB

          MD5

          4ea09ad9dd9bf86c096c31f2e513cab4

          SHA1

          fc8e89996202619a69d546866841dcea5cecc9ee

          SHA256

          73d72fae7459949885c15baa739548c9cbfb1824a1ccaf54dfd6865c4612603c

          SHA512

          a48142a526ac6ec28f1ae2f12869fbcabef8718ed0f4f77253518a161b38e3dd0f88ff303760eb5f94762c121f0899d41b7b1097c7e06dcb77976534e592aa60

        • C:\Users\Admin\AppData\Local\3KR2I7E\mmc.exe

          Filesize

          1.8MB

          MD5

          8c86b80518406f14a4952d67185032d6

          SHA1

          9269f1fbcf65fefbc88a2e239519c21efe0f6ba5

          SHA256

          895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a

          SHA512

          1bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099

        • C:\Users\Admin\AppData\Local\BwMpPT\DWWIN.EXE

          Filesize

          229KB

          MD5

          444cc4d3422a0fdd45c1b78070026c60

          SHA1

          97162ff341fff1ec54b827ec02f8b86fd2d41a97

          SHA256

          4b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0

          SHA512

          21742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553

        • C:\Users\Admin\AppData\Local\BwMpPT\wer.dll

          Filesize

          1.6MB

          MD5

          ccdbf456658a76a14f62060d4f43e782

          SHA1

          78cac76bbb25d74e2d13c354b913e23d88f271c8

          SHA256

          15205a8606a06e34f634bdda476b6bcc85dba604b7c66f6c8e65316bba2aba67

          SHA512

          f804f88e0fadf7d8de500bea71a0792deac2c8aa39367b9f80ad496f2aba73f595924b85f6ab37bc37d963e51a0a2fd736e1df382e432f6725e6a287348028fa

        • C:\Users\Admin\AppData\Local\XYO\AtBroker.exe

          Filesize

          90KB

          MD5

          30076e434a015bdf4c136e09351882cc

          SHA1

          584c958a35e23083a0861421357405afd26d9a0c

          SHA256

          ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd

          SHA512

          675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024

        • C:\Users\Admin\AppData\Local\XYO\UxTheme.dll

          Filesize

          1.6MB

          MD5

          4688097bc6ef275a2d6f2dfc3dc55bb9

          SHA1

          26c86fd3d84d95eff280a0f48f3f1f51cb31cc5e

          SHA256

          be8a087a996543004b43b90976489810c4ece1f81c9ef92162a8ff3cb7309063

          SHA512

          975abb809ce9033d1d2fe771e5a691ef693357f9d77e637a8e8ec122fa6e0868d92a0929bf65f4abd2f1a73cf7acacbf186ea82eb203ad274143fcaf0d75cc1b

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          df627a190baee262a53ae4f2949c68de

          SHA1

          17bf53425d1906f3c83eb60f656be61f528d409d

          SHA256

          b45471affdd73f637fd9c0f593c5dabc6844397c4749d69d75c305c8c4a5e9e0

          SHA512

          6a22bf776c2c7e5a2d9f7acdd25f61c1f22bef0cf296633f78f01ae7a52a04aca465ebf553cbe61bae298a8e906425bd5944d5d539eccfe134b3f008b1ff5123

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\gaWd\MFC42u.dll

          Filesize

          1.6MB

          MD5

          fe91051803ed3d19c397aec8f8336a21

          SHA1

          ae1bb9ce42489d7ec5ce86b7565283f51ff393e5

          SHA256

          5e36fe1acb0ebe3ed421982333dd9a4d625a61ca8a50531ec38e5d0ea1a4fc45

          SHA512

          b47ec126be30aa78cb8a3f6022994ce2f1295a33839a9c93ad4d491d74f8afe1a11dfbc1c83ea91fdded40b1e217cddac23453ad8d5adf8f104819119c263375

        • memory/412-85-0x0000000140000000-0x00000001401A2000-memory.dmp

          Filesize

          1.6MB

        • memory/412-81-0x0000000140000000-0x00000001401A2000-memory.dmp

          Filesize

          1.6MB

        • memory/412-82-0x00000000011E0000-0x00000000011E7000-memory.dmp

          Filesize

          28KB

        • memory/3460-14-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3460-0-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3460-1-0x000001F4E6B70000-0x000001F4E6B77000-memory.dmp

          Filesize

          28KB

        • memory/3488-26-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-35-0x0000000003010000-0x0000000003017000-memory.dmp

          Filesize

          28KB

        • memory/3488-17-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-16-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-18-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-19-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-20-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-21-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-22-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-23-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-24-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-13-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-25-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-27-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-28-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-29-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-30-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-31-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-33-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-15-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-34-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-32-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-42-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-45-0x00007FFB1CBE0000-0x00007FFB1CBF0000-memory.dmp

          Filesize

          64KB

        • memory/3488-52-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-54-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-4-0x0000000003310000-0x0000000003311000-memory.dmp

          Filesize

          4KB

        • memory/3488-12-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-11-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-10-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-9-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-6-0x00007FFB1B1DA000-0x00007FFB1B1DB000-memory.dmp

          Filesize

          4KB

        • memory/3488-8-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/3488-7-0x0000000140000000-0x000000014019B000-memory.dmp

          Filesize

          1.6MB

        • memory/4268-94-0x000001B2F7D50000-0x000001B2F7D57000-memory.dmp

          Filesize

          28KB

        • memory/4268-100-0x0000000140000000-0x000000014019C000-memory.dmp

          Filesize

          1.6MB

        • memory/4268-95-0x0000000140000000-0x000000014019C000-memory.dmp

          Filesize

          1.6MB

        • memory/5108-63-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/5108-64-0x000002E1D0420000-0x000002E1D0427000-memory.dmp

          Filesize

          28KB

        • memory/5108-69-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB