Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21-01-2024 16:15

General

  • Target

    6d744bbf016772634f87aa5fdf2fc9c5.dll

  • Size

    1.4MB

  • MD5

    6d744bbf016772634f87aa5fdf2fc9c5

  • SHA1

    e1b3f458533b0b13502b8fdf2d07d05eb228b467

  • SHA256

    d0c33dbcd2bc26465a2cdf232d5cfea8a77135f9572037c8a0fbe21ae5cd0c2c

  • SHA512

    a7f14f70607bc4b4169427c833c0bb6b7aac746c13f7b990314d01086d4a2d0df2b57b8826afd2812543032484f37b737d652449784a12e8e9852782d5419410

  • SSDEEP

    12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d744bbf016772634f87aa5fdf2fc9c5.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2060
  • C:\Windows\system32\calc.exe
    C:\Windows\system32\calc.exe
    1⤵
      PID:2588
    • C:\Users\Admin\AppData\Local\HPIxUr\calc.exe
      C:\Users\Admin\AppData\Local\HPIxUr\calc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2640
    • C:\Windows\system32\spinstall.exe
      C:\Windows\system32\spinstall.exe
      1⤵
        PID:1668
      • C:\Users\Admin\AppData\Local\YAd\spinstall.exe
        C:\Users\Admin\AppData\Local\YAd\spinstall.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1900
      • C:\Windows\system32\WFS.exe
        C:\Windows\system32\WFS.exe
        1⤵
          PID:2744
        • C:\Users\Admin\AppData\Local\xCWjnC\WFS.exe
          C:\Users\Admin\AppData\Local\xCWjnC\WFS.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:752

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\HPIxUr\VERSION.dll

          Filesize

          1.0MB

          MD5

          87c67c13be591a25ed37c09ffe8a8078

          SHA1

          c5b0ce806e5cd8bc2b3d654d3d97676ac5acb7a5

          SHA256

          a27eb6541964f39331bcf2515a8caa8eb841c0c53b4fb42633556c8b85845adc

          SHA512

          848c4d7f8dca843fdeb1f3659996a4191773dc82543f05ecabbc101bfa5f16bca2f805714571a416a4c09ba6845d0514f3726d8780196f5a8a43d0edc50fb7b8

        • C:\Users\Admin\AppData\Local\HPIxUr\calc.exe

          Filesize

          897KB

          MD5

          10e4a1d2132ccb5c6759f038cdb6f3c9

          SHA1

          42d36eeb2140441b48287b7cd30b38105986d68f

          SHA256

          c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

          SHA512

          9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

        • C:\Users\Admin\AppData\Local\YAd\WTSAPI32.dll

          Filesize

          320KB

          MD5

          ba7a86a07d4a79bfb7244a33e543f8fa

          SHA1

          c1aaf14e17539cee0ea6fd43ceff50f58cd0d931

          SHA256

          79a2a8e5f55add3bd88a04deb5ee3bf8d1cd64de27cfa30c1935ff0ae083e3a3

          SHA512

          f81920abce6b99d7c25a496c773f720c45c5f58f78f80a85a068f3565d30e0598a34c6e61efaec39ee99f7ebcdfb8be264afb3e92528468af43e71d6d19d1f1f

        • C:\Users\Admin\AppData\Local\YAd\spinstall.exe

          Filesize

          448KB

          MD5

          7ecb8e9704df710d5bd546535162f1bc

          SHA1

          56e0ee9a9faf5702343efa5d03ea470ceaa8ae05

          SHA256

          49613fc250d16d4effec004f208f2bbe24f7220375bc5d3a6f64ed87e994795a

          SHA512

          400824f2739f730c938b8ac3231cfd13d640667a53ec1bb2ff9387865cfde1ce4808a036981c56ed683d7d213e10979a7e89378f5a82cf0ec62821c25e79c8ad

        • C:\Users\Admin\AppData\Local\xCWjnC\credui.dll

          Filesize

          1.4MB

          MD5

          e9180b8d59f92b38fb7399b648eda0ae

          SHA1

          88c7aedde9aab4abec1bbfa62425e8d29640f840

          SHA256

          223defcc75297e8265c802179456a01b5de55d2221a2358b5c69d029e6555db0

          SHA512

          1caf9e4d0995be361acef49837fb7b1e64498667f78481c0eb2e907e40a10d0b9be2fe9638c0f1283eeff0ca6e68cb11bf4dee30901e42949824d824cf8b5b84

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Efrsxj.lnk

          Filesize

          1KB

          MD5

          02c51fabfe44853f0cf5775099ebdd50

          SHA1

          d470cfcd7620c22550763a6ed619850b8bc170ac

          SHA256

          100e1df37f89b9c49f722ec3ae3bfbe41db6a6c745c81b327324802031786354

          SHA512

          fba1b6264aeddba2f5f6f3914f5bf2d6b70f5ecb500dba0c64b9a68000ef31861ceb8807b06614d891f7ce88cad1f28c1cd94be3e9e34d6c594b0913a2379a8f

        • \Users\Admin\AppData\Local\HPIxUr\VERSION.dll

          Filesize

          1.4MB

          MD5

          351acddf71758690cc80ac73100f1b19

          SHA1

          2ef9f25046432aa3722f46443a77539732cb8595

          SHA256

          78520e1be605bd74981bab62c52decaf8d41c1ad1844346fa57bc816fb5e4a74

          SHA512

          75eaabfd3a474c6822d3757f7518c900edf64d49e10eabcb8afc5eae16bd09f7a98f6507ccf2eb45b8a7e6ac62cb9ecc40ccfea3782c4096b69afd0a03e4b9dd

        • \Users\Admin\AppData\Local\YAd\WTSAPI32.dll

          Filesize

          1.4MB

          MD5

          03966c64269893c80162606bd5c2c666

          SHA1

          d18176057e17622c04d4493b4ca6fa7b477f4dd6

          SHA256

          00d0635ca687ed2ce55b8f864f9b37240d25c28a83c6a8dcaf378154d2734cf7

          SHA512

          50ebbb7a1cd032e168df53c088e1c7bc2bdd26b37d066bd3b13b42867661fe372a94a98779936ece4d1a72350aa816d56e12a336cd71f041c214f712eabfbff0

        • \Users\Admin\AppData\Local\YAd\spinstall.exe

          Filesize

          584KB

          MD5

          29c1d5b330b802efa1a8357373bc97fe

          SHA1

          90797aaa2c56fc2a667c74475996ea1841bc368f

          SHA256

          048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f

          SHA512

          66f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee

        • \Users\Admin\AppData\Local\xCWjnC\WFS.exe

          Filesize

          951KB

          MD5

          a943d670747778c7597987a4b5b9a679

          SHA1

          c48b760ff9762205386563b93e8884352645ef40

          SHA256

          1a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610

          SHA512

          3d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934

        • memory/752-112-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB

        • memory/752-107-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/1200-29-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-42-0x0000000077001000-0x0000000077002000-memory.dmp

          Filesize

          4KB

        • memory/1200-19-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-20-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-18-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-17-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-24-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-23-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-22-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-26-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-27-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-25-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-21-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-32-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-31-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-30-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-128-0x0000000076DF6000-0x0000000076DF7000-memory.dmp

          Filesize

          4KB

        • memory/1200-28-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-41-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-40-0x0000000002B10000-0x0000000002B17000-memory.dmp

          Filesize

          28KB

        • memory/1200-33-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-16-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-43-0x0000000077160000-0x0000000077162000-memory.dmp

          Filesize

          8KB

        • memory/1200-52-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-58-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-61-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-15-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-14-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-4-0x0000000076DF6000-0x0000000076DF7000-memory.dmp

          Filesize

          4KB

        • memory/1200-5-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1200-13-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-9-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-10-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-12-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-11-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1200-7-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/1900-90-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/1900-94-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB

        • memory/2060-8-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/2060-1-0x0000000140000000-0x0000000140168000-memory.dmp

          Filesize

          1.4MB

        • memory/2060-0-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2640-75-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB

        • memory/2640-70-0x0000000000200000-0x0000000000207000-memory.dmp

          Filesize

          28KB

        • memory/2640-71-0x0000000140000000-0x0000000140169000-memory.dmp

          Filesize

          1.4MB