Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2024 10:46

General

  • Target

    72069f253d65873ca37d22ed502e1911.dll

  • Size

    3.7MB

  • MD5

    72069f253d65873ca37d22ed502e1911

  • SHA1

    551a0c0ea3996301997e8f133c3ab4933456b7db

  • SHA256

    95675ed8705063e78d6feec16544b7d5bbe62b4bc34b13462280c0ec046f0d71

  • SHA512

    113a86c3fd39d5cb43ccfbee1a8ca8a0f2c08d76439eb39c228f1a56432ab121f61696087b21df958b15b16b16c3169d5109aac638ab60b91eb4ce76b9dc52a1

  • SSDEEP

    12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1K8yQy:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnbKn

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\72069f253d65873ca37d22ed502e1911.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:3880
  • C:\Windows\system32\bdeunlock.exe
    C:\Windows\system32\bdeunlock.exe
    1⤵
      PID:1016
    • C:\Users\Admin\AppData\Local\xW0\bdeunlock.exe
      C:\Users\Admin\AppData\Local\xW0\bdeunlock.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2664
    • C:\Windows\system32\mstsc.exe
      C:\Windows\system32\mstsc.exe
      1⤵
        PID:2612
      • C:\Users\Admin\AppData\Local\CkXWAn\mstsc.exe
        C:\Users\Admin\AppData\Local\CkXWAn\mstsc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4136
      • C:\Windows\system32\psr.exe
        C:\Windows\system32\psr.exe
        1⤵
          PID:2668
        • C:\Users\Admin\AppData\Local\pvrwm\psr.exe
          C:\Users\Admin\AppData\Local\pvrwm\psr.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1408

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\CkXWAn\VERSION.dll

          Filesize

          3.8MB

          MD5

          8bb25105d9d5636041ccf2ca13433658

          SHA1

          88470fc4fbfb1f4556606f5450147445f2fc2b85

          SHA256

          8d0df2b516e3ed11d8e79855e9df02f354ca679d2b9c5b0ef19a980d993bf213

          SHA512

          33a5e5f6e053c0215f804d62743fc12e990d1c3f3e04eb1a891fd8bad7380c37c91d56927bb51f7d8c212e864ac18cc431eebdc8eecdd6a3dedc597d8c7f5639

        • C:\Users\Admin\AppData\Local\CkXWAn\mstsc.exe

          Filesize

          1.5MB

          MD5

          3a26640414cee37ff5b36154b1a0b261

          SHA1

          e0c28b5fdf53a202a7543b67bbc97214bad490ed

          SHA256

          1d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f

          SHA512

          76fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2

        • C:\Users\Admin\AppData\Local\pvrwm\XmlLite.dll

          Filesize

          3.8MB

          MD5

          381797e980c95b8424c041050d038876

          SHA1

          7b1bba3615385706886afc863ebdd56e891bfd5f

          SHA256

          795e0cbd6ca8a2e7de9c73ced032b6626be2765a991eefc56894ed61a7cd3b28

          SHA512

          f7f39f1de9c268e2df962b9c2c4ce159952176687be8b9f9242ae01ef557761256ec4791abad6481c9db4da3ea556a72a5daaf2f9935526645c18c534e993c70

        • C:\Users\Admin\AppData\Local\pvrwm\psr.exe

          Filesize

          232KB

          MD5

          ad53ead5379985081b7c3f1f357e545a

          SHA1

          6f5aa32c1d15fbf073558fadafd046d97b60184e

          SHA256

          4f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f

          SHA512

          433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0

        • C:\Users\Admin\AppData\Local\xW0\DUI70.dll

          Filesize

          4.0MB

          MD5

          684cce04b25930b040dbf691f6ff580b

          SHA1

          ba17ae8cbf0893bd298169e0e6928d237211ec19

          SHA256

          202e8fcf040fae82f7a4444ba2d7d2163b1e1fd24a373815746c051d66342e15

          SHA512

          912df62be718a70c60d9d49e97595f6bdfb07ee8d005d99a29d9d6088a8d26ca8771f84290d2b9d4bdc2d8b8d2ce7917cc9ee4c78b0f9bf5c308fb56a088bf94

        • C:\Users\Admin\AppData\Local\xW0\bdeunlock.exe

          Filesize

          279KB

          MD5

          fef5d67150c249db3c1f4b30a2a5a22e

          SHA1

          41ca037b0229be9338da4d78244b4f0ea5a3d5f3

          SHA256

          dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603

          SHA512

          4ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          517a498ad016bf4c1bd8bdb48099201b

          SHA1

          ad784f8544fdc339a0deeb22f5fd4c4649e7648a

          SHA256

          9283110c19063c935b355035646970db45652b7d5435f8bc0fde24b7c753bc02

          SHA512

          bb47da33c6bea430ba27ec32d90835adba7a5543bff106625a5bb073cde01e5d13fb4dd65303ca68bcf25897971e2fd80635a4d678ba56f8533cf115fd32633a

        • memory/1408-134-0x000001CD913C0000-0x000001CD913C7000-memory.dmp

          Filesize

          28KB

        • memory/2664-99-0x000002942D390000-0x000002942D397000-memory.dmp

          Filesize

          28KB

        • memory/3532-39-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-46-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-14-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-15-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-16-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-17-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-19-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-20-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-4-0x0000000003290000-0x0000000003291000-memory.dmp

          Filesize

          4KB

        • memory/3532-21-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-22-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-23-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-24-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-25-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-26-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-27-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-28-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-29-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-30-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-31-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-32-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-33-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-34-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-35-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-36-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-37-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-38-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-7-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-40-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-41-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-42-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-43-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-44-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-13-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-47-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-45-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-48-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-49-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-50-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-51-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-52-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-53-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-54-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-55-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-56-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-57-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-58-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-59-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-60-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-61-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-62-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-63-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-64-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-65-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-70-0x0000000001460000-0x0000000001467000-memory.dmp

          Filesize

          28KB

        • memory/3532-78-0x00007FFCF0B80000-0x00007FFCF0B90000-memory.dmp

          Filesize

          64KB

        • memory/3532-11-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-12-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-10-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-9-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3532-6-0x00007FFCEFC8A000-0x00007FFCEFC8B000-memory.dmp

          Filesize

          4KB

        • memory/3532-8-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3880-1-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3880-18-0x0000000140000000-0x00000001403BF000-memory.dmp

          Filesize

          3.7MB

        • memory/3880-0-0x000001DC38E40000-0x000001DC38E47000-memory.dmp

          Filesize

          28KB

        • memory/4136-116-0x000001CE9E4B0000-0x000001CE9E4B7000-memory.dmp

          Filesize

          28KB