Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21-01-2024 16:02

General

  • Target

    6d6d6e2d25e5004f0487405fdb25a600.dll

  • Size

    1.4MB

  • MD5

    6d6d6e2d25e5004f0487405fdb25a600

  • SHA1

    ef4b1bba3fc0114114c00180262f1404a88e66b0

  • SHA256

    6c28f1dd1c3bbf1187846af408ba671bf0fb28984469e666b284d4f4b1c3a823

  • SHA512

    8a8d615f34930e4eb5d717414e3443771caff2416815ed529ba4a0a2ec7fb5fe6637198d6482626dcd3f0edd428776a637c8608cc00fcbf35eff55812bd24608

  • SSDEEP

    12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d6d6e2d25e5004f0487405fdb25a600.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2496
  • C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
    C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
    1⤵
      PID:2620
    • C:\Users\Admin\AppData\Local\hAkyUKUK\SystemPropertiesDataExecutionPrevention.exe
      C:\Users\Admin\AppData\Local\hAkyUKUK\SystemPropertiesDataExecutionPrevention.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2640
    • C:\Windows\system32\tcmsetup.exe
      C:\Windows\system32\tcmsetup.exe
      1⤵
        PID:2028
      • C:\Users\Admin\AppData\Local\y8jTT\tcmsetup.exe
        C:\Users\Admin\AppData\Local\y8jTT\tcmsetup.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1588
      • C:\Windows\system32\osk.exe
        C:\Windows\system32\osk.exe
        1⤵
          PID:2816
        • C:\Users\Admin\AppData\Local\BHKZxD0\osk.exe
          C:\Users\Admin\AppData\Local\BHKZxD0\osk.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2920

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\BHKZxD0\osk.exe

          Filesize

          676KB

          MD5

          b918311a8e59fb8ccf613a110024deba

          SHA1

          a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b

          SHA256

          e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353

          SHA512

          e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1

        • C:\Users\Admin\AppData\Local\hAkyUKUK\SYSDM.CPL

          Filesize

          1.4MB

          MD5

          c2643eae06ac9cc0fda13c796c36131e

          SHA1

          51316ed272064e37e459f20a8c8a2f6add3412b2

          SHA256

          bfaeec6613997bcf82e41077fa1d02a934cd361e1d168ad1e7d9a50b9ae96d97

          SHA512

          b81551be9ca442da82e2ddf901f03a2033eb90343a58756ce95bb89d32ca939e233b2ccffa9ca41ec22648a0039c09897ea662f3c69b0a71ddf9106dc439d984

        • C:\Users\Admin\AppData\Local\y8jTT\TAPI32.dll

          Filesize

          1.4MB

          MD5

          f5aaf822675f3ff5565f64ebac272d39

          SHA1

          c687794391440629118bfa9e3d16f51e9c9510f8

          SHA256

          fd61a51c15cbf35e632938333ac5e1f3c472bb7760e6645ad1e9a5fdf586e111

          SHA512

          be7541443ef8841103000470f21121ef83f59b3e639fa36e4f9fba898b5644a5b55a91c831d195f4aad8b069739a52707876314f41d2a1bbc92554c9b9ec7f14

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          4226746aea5e60126dc602df3d4a0de4

          SHA1

          b296a138183d36798e6b6bac886f43bbd7e45bf8

          SHA256

          76e13d0cf8e2d2e699532d880ab6862794248a51b818a56700fac621f02d50a7

          SHA512

          3a858b5796626a82e506f257403234c7205522855ce085f2b463bb4b5bea39d215b4b2ec5cb5947065175e6266bf6cf8c2aaf079a99bcec6f0162e17a8d2ca67

        • \Users\Admin\AppData\Local\BHKZxD0\dwmapi.dll

          Filesize

          1.4MB

          MD5

          62a31f0c69e4e51ba92f9ce221491ba5

          SHA1

          1fc006d6fe2cb3b510e25c7ff7e0619061fb2ae8

          SHA256

          ddf59b686325b020bf449b76cbd93f716854c3075f239f2cb37ef9400c7e9566

          SHA512

          d579914db5e53b527172bac4b67705eac8af1364a0f553929d8a607d498a9baf07794fd4966b96b46b9942bffa3d45dfc2ada9317642422be42b13d26a7c91f8

        • \Users\Admin\AppData\Local\BHKZxD0\osk.exe

          Filesize

          576KB

          MD5

          b5ccc580308ea920c8c0e31d17f21b23

          SHA1

          0d760edb7f98c92a96ee84870f160ca282863763

          SHA256

          49bd64d5d22fe03b6fcdb6651c97e99e77c86d1bfc338f51879bb6b5cd597781

          SHA512

          18f6065b985197f0c3764da8f22ae9f56d589c1b83f447a2b0bbb6287c43059d7d534b90a7ce660e8a5a36e1a8a2a0cfe6f944b4b384e14901d6b66461ccf272

        • \Users\Admin\AppData\Local\hAkyUKUK\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          80KB

          MD5

          e43ff7785fac643093b3b16a9300e133

          SHA1

          a30688e84c0b0a22669148fe87680b34fcca2fba

          SHA256

          c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b

          SHA512

          61260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a

        • \Users\Admin\AppData\Local\y8jTT\tcmsetup.exe

          Filesize

          15KB

          MD5

          0b08315da0da7f9f472fbab510bfe7b8

          SHA1

          33ba48fd980216becc532466a5ff8476bec0b31c

          SHA256

          e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7

          SHA512

          c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58

        • memory/1188-15-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-33-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-14-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-13-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-16-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-17-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-131-0x00000000773A6000-0x00000000773A7000-memory.dmp

          Filesize

          4KB

        • memory/1188-19-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-20-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-18-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-22-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-21-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-24-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-23-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-27-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-25-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-26-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-28-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-30-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-29-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-32-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-31-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-34-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-12-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-35-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-38-0x0000000002A50000-0x0000000002A57000-memory.dmp

          Filesize

          28KB

        • memory/1188-37-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-36-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-45-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-47-0x0000000077710000-0x0000000077712000-memory.dmp

          Filesize

          8KB

        • memory/1188-46-0x00000000775B1000-0x00000000775B2000-memory.dmp

          Filesize

          4KB

        • memory/1188-56-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-62-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-11-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-10-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-4-0x00000000773A6000-0x00000000773A7000-memory.dmp

          Filesize

          4KB

        • memory/1188-5-0x0000000002A80000-0x0000000002A81000-memory.dmp

          Filesize

          4KB

        • memory/1188-7-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1188-9-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/1588-92-0x0000000140000000-0x000000014016E000-memory.dmp

          Filesize

          1.4MB

        • memory/1588-94-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/1588-98-0x0000000140000000-0x000000014016E000-memory.dmp

          Filesize

          1.4MB

        • memory/2496-8-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/2496-0-0x0000000140000000-0x000000014016C000-memory.dmp

          Filesize

          1.4MB

        • memory/2496-2-0x00000000001A0000-0x00000000001A7000-memory.dmp

          Filesize

          28KB

        • memory/2640-80-0x0000000140000000-0x000000014016D000-memory.dmp

          Filesize

          1.4MB

        • memory/2640-75-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2640-74-0x0000000140000000-0x000000014016D000-memory.dmp

          Filesize

          1.4MB