Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2024 03:23

General

  • Target

    6e98953bf2fdd7c3a404f182f3070944.dll

  • Size

    1.1MB

  • MD5

    6e98953bf2fdd7c3a404f182f3070944

  • SHA1

    e547a54cfbc50fcfc2bf78c348984e7b6b1183ce

  • SHA256

    995bc9b977d5419139f29029dd2d9df2ce41f3a0496ec39a37946620a20d877a

  • SHA512

    e50c9ec714413a89c14492af9d1dffa90e20be98411b44c6df78d0b751ade15cef5476aae6b4d6f3b143146fddc0345366dbda75593926d97e05b23ec9a4521b

  • SSDEEP

    12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e98953bf2fdd7c3a404f182f3070944.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2772
  • C:\Windows\system32\calc.exe
    C:\Windows\system32\calc.exe
    1⤵
      PID:3028
    • C:\Users\Admin\AppData\Local\GukUKJE2\calc.exe
      C:\Users\Admin\AppData\Local\GukUKJE2\calc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2404
    • C:\Windows\system32\psr.exe
      C:\Windows\system32\psr.exe
      1⤵
        PID:1172
      • C:\Users\Admin\AppData\Local\ZGEKhbfKL\psr.exe
        C:\Users\Admin\AppData\Local\ZGEKhbfKL\psr.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1276
      • C:\Windows\system32\recdisc.exe
        C:\Windows\system32\recdisc.exe
        1⤵
          PID:988
        • C:\Users\Admin\AppData\Local\Y39E0mafX\recdisc.exe
          C:\Users\Admin\AppData\Local\Y39E0mafX\recdisc.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2872
        • C:\Windows\system32\tabcal.exe
          C:\Windows\system32\tabcal.exe
          1⤵
            PID:2628
          • C:\Users\Admin\AppData\Local\SuPZMa\tabcal.exe
            C:\Users\Admin\AppData\Local\SuPZMa\tabcal.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:2156

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\GukUKJE2\VERSION.dll

            Filesize

            1.2MB

            MD5

            bde6641292d720dd56057a18e50922f5

            SHA1

            98f6913079c749af587c26852d5f27738277b351

            SHA256

            24720d623864c0f590d9dad00114c20bf621bede64bc02ae765f62d72643d8e0

            SHA512

            0dc6d040ace983fde7f82f72d5af7a334cce266817c00cfab699ffc59bce425e12ed30e961e83098b079e7a77c9347bfdd022e736144cf5544c8c9a24ff9e471

          • C:\Users\Admin\AppData\Local\SuPZMa\HID.DLL

            Filesize

            1.2MB

            MD5

            ea59b40082dd620886c253cc44b756bf

            SHA1

            4945943bba6cd323c3f7a57ee103c7ec1eff6881

            SHA256

            f3256ed7f6e6d45ca4b2ec6f81aab0b8928dee84097f88848a6b480712c1b225

            SHA512

            0021d3d67b1ff435ce65e45613f1223d4d1ffd6830c7290e5406d889fb0b44ba2e4570065d8474034ca9b68d6041ff21d9aa4bf3173f872a23872beb1e791545

          • C:\Users\Admin\AppData\Local\Y39E0mafX\ReAgent.dll

            Filesize

            1.2MB

            MD5

            adf6b7f83f587ff6a4f2702c60a3a0b3

            SHA1

            768cd893c31c1f29b447a467b23a772b0decee1b

            SHA256

            4388a8b5332e0989261e0205bf948361ee2ac4e169f003220ff248f9216460a2

            SHA512

            fac2cee79a20e89ac2ced81252c42284f4ae1156f94281213d9622b2b24cb7bdebb56a168e81e0ba8f1bcaaa9b04b9fae7878e106ef51f0785e29020f96dafc8

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

            Filesize

            1KB

            MD5

            66a497b400e738e6be2e940e775d4993

            SHA1

            12b3c17e250da0387ab2d418d5646e84a7343d50

            SHA256

            d31d2da9d91444670f407be7d258c244357474be667409de60282c2bc42ff674

            SHA512

            6b768b21c2f6ddde11eb2045f772a173c04e4c0859e8420e0144c38dcabaab4b8d6b17159a7e30798289ed7a2f1092d2ba469b9c0411981d7e2ddbbf419d8d3b

          • \Users\Admin\AppData\Local\GukUKJE2\calc.exe

            Filesize

            897KB

            MD5

            10e4a1d2132ccb5c6759f038cdb6f3c9

            SHA1

            42d36eeb2140441b48287b7cd30b38105986d68f

            SHA256

            c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

            SHA512

            9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

          • \Users\Admin\AppData\Local\SuPZMa\tabcal.exe

            Filesize

            77KB

            MD5

            98e7911befe83f76777317ce6905666d

            SHA1

            2780088dffe1dd1356c5dd5112a9f04afee3ee8d

            SHA256

            3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1

            SHA512

            fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

          • \Users\Admin\AppData\Local\Y39E0mafX\recdisc.exe

            Filesize

            232KB

            MD5

            f3b306179f1840c0813dc6771b018358

            SHA1

            dec7ce3c13f7a684cb52ae6007c99cf03afef005

            SHA256

            dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0

            SHA512

            9f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4

          • \Users\Admin\AppData\Local\ZGEKhbfKL\OLEACC.dll

            Filesize

            1.2MB

            MD5

            954ce73f0386a69a3335b4432b12e343

            SHA1

            7c6b3ee8c8e868c43253f1d6a857976e1e92ecb3

            SHA256

            d69dd0208a409d4b1a2d5566bbccad1d780b23bae4f9d812b2659474c371c81d

            SHA512

            5da3d4469c6d66c16abe166ff7cf320df6feb1288700289198b147b41108854e667e3ebeddfc6bdeb5bb660b6e0cd665f6cbe9972eb566c0bde2d995760ef00f

          • \Users\Admin\AppData\Local\ZGEKhbfKL\psr.exe

            Filesize

            715KB

            MD5

            a80527109d75cba125d940b007eea151

            SHA1

            facf32a9ede6abfaa09368bfdfcfec8554107272

            SHA256

            68910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495

            SHA512

            77b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774

          • memory/1228-31-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-41-0x0000000077381000-0x0000000077382000-memory.dmp

            Filesize

            4KB

          • memory/1228-15-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-14-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-17-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-16-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-19-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-18-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-21-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-20-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-22-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-24-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-23-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-25-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-26-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-28-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-27-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-29-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-30-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-141-0x0000000077176000-0x0000000077177000-memory.dmp

            Filesize

            4KB

          • memory/1228-33-0x0000000002730000-0x0000000002737000-memory.dmp

            Filesize

            28KB

          • memory/1228-32-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-40-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-13-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-42-0x00000000774E0000-0x00000000774E2000-memory.dmp

            Filesize

            8KB

          • memory/1228-51-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-55-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-56-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-60-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-12-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-7-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-4-0x0000000077176000-0x0000000077177000-memory.dmp

            Filesize

            4KB

          • memory/1228-5-0x0000000002A00000-0x0000000002A01000-memory.dmp

            Filesize

            4KB

          • memory/1228-10-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-11-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1228-9-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/1276-87-0x00000000000F0000-0x00000000000F7000-memory.dmp

            Filesize

            28KB

          • memory/1276-91-0x0000000140000000-0x0000000140127000-memory.dmp

            Filesize

            1.2MB

          • memory/2156-121-0x0000000000270000-0x0000000000277000-memory.dmp

            Filesize

            28KB

          • memory/2404-75-0x0000000140000000-0x0000000140127000-memory.dmp

            Filesize

            1.2MB

          • memory/2404-69-0x0000000000100000-0x0000000000107000-memory.dmp

            Filesize

            28KB

          • memory/2404-70-0x0000000140000000-0x0000000140127000-memory.dmp

            Filesize

            1.2MB

          • memory/2772-8-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/2772-0-0x0000000000110000-0x0000000000117000-memory.dmp

            Filesize

            28KB

          • memory/2772-1-0x0000000140000000-0x0000000140126000-memory.dmp

            Filesize

            1.1MB

          • memory/2872-102-0x0000000001B50000-0x0000000001B57000-memory.dmp

            Filesize

            28KB

          • memory/2872-107-0x0000000140000000-0x0000000140127000-memory.dmp

            Filesize

            1.2MB