Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2024 10:55

General

  • Target

    6f7d97ba73906e0867f0f46d5c537049.dll

  • Size

    1.5MB

  • MD5

    6f7d97ba73906e0867f0f46d5c537049

  • SHA1

    4760cd9fbb77d0a05a0f5a86a70ea98057e3bce3

  • SHA256

    9abc5f5cc3312da7b9eb0e44a7a2306afd47d84c49b9cb86ed120cadfc05c824

  • SHA512

    631240994428b1f4ce8ab54362384c7460ae14f97063c2320c33a3110f3daa7d4c6fee969bded9fead352bdd47c52c4a139877c8b52e5f4cf21915cfe61dd634

  • SSDEEP

    12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7d97ba73906e0867f0f46d5c537049.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2448
  • C:\Windows\system32\BitLockerWizardElev.exe
    C:\Windows\system32\BitLockerWizardElev.exe
    1⤵
      PID:324
    • C:\Users\Admin\AppData\Local\iOLCtp4kk\BitLockerWizardElev.exe
      C:\Users\Admin\AppData\Local\iOLCtp4kk\BitLockerWizardElev.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1728
    • C:\Windows\system32\shrpubw.exe
      C:\Windows\system32\shrpubw.exe
      1⤵
        PID:2204
      • C:\Users\Admin\AppData\Local\oPrXNnp\shrpubw.exe
        C:\Users\Admin\AppData\Local\oPrXNnp\shrpubw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1864
      • C:\Windows\system32\fveprompt.exe
        C:\Windows\system32\fveprompt.exe
        1⤵
          PID:1944
        • C:\Users\Admin\AppData\Local\FsDb\fveprompt.exe
          C:\Users\Admin\AppData\Local\FsDb\fveprompt.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1736

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\iOLCtp4kk\BitLockerWizardElev.exe

          Filesize

          98KB

          MD5

          73f13d791e36d3486743244f16875239

          SHA1

          ed5ec55dbc6b3bda505f0a4c699c257c90c02020

          SHA256

          2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

          SHA512

          911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

        • C:\Users\Admin\AppData\Local\iOLCtp4kk\FVEWIZ.dll

          Filesize

          1.5MB

          MD5

          c338f3236bebfca55f5ee1113b2a63e8

          SHA1

          2f907b6c463a3c3577c63e125ee219cbbfd1d972

          SHA256

          d3b36a4222fc21dd9eac4c533c2e84f1b239b54ff23c22fce4cb5d7854f18aee

          SHA512

          d94b55f7e6b7500ece9d3396f8fc9055dc377b0644a67295569a5b15a6691aeb26bec3e8196c40bd41359f3fe83ad892bef4656907e79b32323dbea3701eb7bc

        • C:\Users\Admin\AppData\Local\oPrXNnp\MFC42u.dll

          Filesize

          1.5MB

          MD5

          692082607b170df2c355ff99e2b6d747

          SHA1

          843bc4849ab9036e7cd8fafa10ba98e6d20bfb5f

          SHA256

          1612a214923e9b7d61a6b9403dbe75f2aad84148759447d60ee06b01b68e3ba6

          SHA512

          2e8a3c562ea18b783d75cfbe3575fdc692b5ba2f5a425d1eddc5a5ebb1880ad59943e064c9da017eb262a467d9b4015c07a9d4285151ccf872a624384a193f17

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          1e187829c2ffe0eda1b1b6e82f5fb625

          SHA1

          c392b5c68c7ab796b27305b8c979079be53d17a9

          SHA256

          59a85e9a03c10cb0aab39163428beec66ea9f3c3e8f4f33585218c6924417dd4

          SHA512

          889a98c89fb0af661f656d9c0ad1cba83f99b1cc878908ee46d475de507dba3a5b5e7e509ba9935e44ef40aff1bfed145ebbb486f600d53e5b7c2cddf174fadb

        • \Users\Admin\AppData\Local\FsDb\fveprompt.exe

          Filesize

          104KB

          MD5

          dc2c44a23b2cd52bd53accf389ae14b2

          SHA1

          e36c7b6f328aa2ab2f52478169c52c1916f04b5f

          SHA256

          7f5b19f2c6a94833196ee1929d48094889b33b504d73d3af88dd857ceaf67921

          SHA512

          ff083f74777a9cfc940d4e0cb55886397e27c85f867de9a5dd9ea2c2751d2a77bf75fe0734e424d9678c83e927788d07d0b3072024f7e5a9848c7ff1aa4090dc

        • \Users\Admin\AppData\Local\FsDb\slc.dll

          Filesize

          1.5MB

          MD5

          c1102bdd574a4b1dd56329a7d04334fa

          SHA1

          fae430640c4e72efe27cfc5bc01ae3c4cdd23b0c

          SHA256

          5d66e82dafb6657a5a0675fc52ce0202cadc3e36c22ab04a50d89b3eb201a072

          SHA512

          24a7364b743a77fc081200d28c09e3a2f6fc775857229b2ffbb051d995989fd759d128b57b340e8c48c402c97216a11d6b3072c4bae088105cb3f7a08c64f52d

        • \Users\Admin\AppData\Local\oPrXNnp\shrpubw.exe

          Filesize

          398KB

          MD5

          29e6d0016611c8f948db5ea71372f76c

          SHA1

          01d007a01020370709cd6580717f9ace049647e8

          SHA256

          53c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930

          SHA512

          300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4

        • memory/1240-36-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-38-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-15-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-19-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-18-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-17-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-16-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-23-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-24-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-22-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-21-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-20-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-29-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-28-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-27-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-26-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-25-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-35-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-34-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-33-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-32-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-31-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-30-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-4-0x0000000076DB6000-0x0000000076DB7000-memory.dmp

          Filesize

          4KB

        • memory/1240-41-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-40-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-39-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-14-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-37-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-43-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-42-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-45-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-46-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-44-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-47-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-48-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-50-0x00000000021E0000-0x00000000021E7000-memory.dmp

          Filesize

          28KB

        • memory/1240-56-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-57-0x0000000076EC1000-0x0000000076EC2000-memory.dmp

          Filesize

          4KB

        • memory/1240-58-0x0000000077020000-0x0000000077022000-memory.dmp

          Filesize

          8KB

        • memory/1240-67-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-73-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-11-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-12-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-5-0x00000000025C0000-0x00000000025C1000-memory.dmp

          Filesize

          4KB

        • memory/1240-13-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-10-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-145-0x0000000076DB6000-0x0000000076DB7000-memory.dmp

          Filesize

          4KB

        • memory/1240-9-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1240-7-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/1728-85-0x0000000000170000-0x0000000000177000-memory.dmp

          Filesize

          28KB

        • memory/1736-125-0x0000000000320000-0x0000000000327000-memory.dmp

          Filesize

          28KB

        • memory/1864-103-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2448-0-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB

        • memory/2448-2-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2448-8-0x0000000140000000-0x0000000140185000-memory.dmp

          Filesize

          1.5MB