Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2024 14:05

General

  • Target

    726f982410725cb34272e9e44b3c0310.dll

  • Size

    2.0MB

  • MD5

    726f982410725cb34272e9e44b3c0310

  • SHA1

    8450bd8609660c8fee5e0a8460e391b44ef07bfd

  • SHA256

    1af3b38b228078c0c78e70ef3bf82e55635240069d5f982819899db2bf5d9972

  • SHA512

    e1540efb22d0c7bf2f5a0f1a9ad38f0d78d741db0c49c4628f620f315e4a093b449628b12aabd597c89042344318b3db6dad4ca03e3390d67944c84f72cfb728

  • SSDEEP

    12288:MVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:5fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\726f982410725cb34272e9e44b3c0310.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2040
  • C:\Windows\system32\p2phost.exe
    C:\Windows\system32\p2phost.exe
    1⤵
      PID:2620
    • C:\Users\Admin\AppData\Local\vXpgWYYf\p2phost.exe
      C:\Users\Admin\AppData\Local\vXpgWYYf\p2phost.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3060
    • C:\Windows\system32\StikyNot.exe
      C:\Windows\system32\StikyNot.exe
      1⤵
        PID:1636
      • C:\Users\Admin\AppData\Local\j70Vbi1\StikyNot.exe
        C:\Users\Admin\AppData\Local\j70Vbi1\StikyNot.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1092
      • C:\Windows\system32\WFS.exe
        C:\Windows\system32\WFS.exe
        1⤵
          PID:2932
        • C:\Users\Admin\AppData\Local\3ZPNdgpT\WFS.exe
          C:\Users\Admin\AppData\Local\3ZPNdgpT\WFS.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2956

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\3ZPNdgpT\credui.dll

          Filesize

          1.1MB

          MD5

          f700863ff7b9e5dffcbb473d5004aa7c

          SHA1

          67df03da729316ca71b93d29f76f61b7e760e864

          SHA256

          ee13b7d68a2029c48cd4bd59c42e0b1a612a98148c4b8b962b39f283d986396c

          SHA512

          574c758b2e9e9c207afc40151467b97585d0485ffcacc547e385b931294b469f25c4e113eeb4891c860a96486a017170f6609cc092fb9deea6cf82063af8d60c

        • C:\Users\Admin\AppData\Local\j70Vbi1\slc.dll

          Filesize

          2.0MB

          MD5

          389e5f672ae14f4c6348ac833459fb9d

          SHA1

          885b2702fe55cc21923c89c0c311cccb4d2087f5

          SHA256

          c7563823eba650b99aa97a7b02e80f936b47c13edfed7206578d6224807a8333

          SHA512

          ce730bf4f1fe46ff414e17cf0439850468b65440cdad4eb946ae83461965c90ff753401df57bbdb0836b1e1ac4870f7a6a5c4526f9956c8073b1c96b3f6016f7

        • C:\Users\Admin\AppData\Local\vXpgWYYf\P2PCOLLAB.dll

          Filesize

          2.0MB

          MD5

          c4a9023a87e0bd135e4f37fcd1742d4c

          SHA1

          e41a01500c2811f145781cba7be9eb3546fa77d3

          SHA256

          e8c4003f0fc23e8515493136840d9be36c81b35a71bc647b0d0b5c256f948475

          SHA512

          001d2175b10f1b9f91508d90f14eba9ea4375e57ed649bbeda6873d96daaa794918607449694d60ee7628b5670ef9fc9bbb56e485d6f72f156939478bc4a6966

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          0da2e7a17ddc3c8a8596faf645c14088

          SHA1

          2e5c209e004404140b4a4747e0c032a83d5ac441

          SHA256

          00857d0bdc9550e97e53164f61297ba154b76f14781bced8aabc2b28549fdb6b

          SHA512

          393c0f39b1149b67a5cc01628b013a16b779803966ad5453424147fd421d1743b9aa5634313a3ae9c5589b21aec75b035854e59fc2fd551a967b7edad76860aa

        • \Users\Admin\AppData\Local\3ZPNdgpT\WFS.exe

          Filesize

          951KB

          MD5

          a943d670747778c7597987a4b5b9a679

          SHA1

          c48b760ff9762205386563b93e8884352645ef40

          SHA256

          1a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610

          SHA512

          3d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934

        • \Users\Admin\AppData\Local\3ZPNdgpT\credui.dll

          Filesize

          2.0MB

          MD5

          3465d3ca47eceb7b6f894678f79f7d22

          SHA1

          3225e7c426e038443ec99aaa518ebc8425a16567

          SHA256

          b0d42e7b78e85b58bd43732117c5aefe975f375b244d95000c39f125f7300395

          SHA512

          ac452a22160ea7277a0261c094bdde995398ccaf44d6899d48e1e8a99c1c1915393a8d974155ac477b7ff57698eb1741cb62208b376b34ce90f339c1b32a176d

        • \Users\Admin\AppData\Local\j70Vbi1\StikyNot.exe

          Filesize

          417KB

          MD5

          b22cb67919ebad88b0e8bb9cda446010

          SHA1

          423a794d26d96d9f812d76d75fa89bffdc07d468

          SHA256

          2f744feac48ede7d6b6d2727f7ddfa80b26d9e3b0009741b00992b19ad85e128

          SHA512

          f40aad2a381b766aae0a353fae3ab759d5c536b2d00d135527bba37b601d2f24323f079bd09600355d79404d574ac59201d415ef64c1568877ad0ce0da2dd1d5

        • \Users\Admin\AppData\Local\vXpgWYYf\p2phost.exe

          Filesize

          172KB

          MD5

          0dbd420477352b278dfdc24f4672b79c

          SHA1

          df446f25be33ac60371557717073249a64e04bb2

          SHA256

          1baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345

          SHA512

          84014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1

        • memory/1092-104-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/1092-99-0x0000000000290000-0x0000000000297000-memory.dmp

          Filesize

          28KB

        • memory/1208-34-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-48-0x0000000077AA1000-0x0000000077AA2000-memory.dmp

          Filesize

          4KB

        • memory/1208-20-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-21-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-19-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-18-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-22-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-23-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-24-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-25-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-26-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-27-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-28-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-29-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-31-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-30-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-33-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-32-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-4-0x0000000077996000-0x0000000077997000-memory.dmp

          Filesize

          4KB

        • memory/1208-35-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-36-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-38-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-39-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-37-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-40-0x0000000002140000-0x0000000002147000-memory.dmp

          Filesize

          28KB

        • memory/1208-16-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-47-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-49-0x0000000077C00000-0x0000000077C02000-memory.dmp

          Filesize

          8KB

        • memory/1208-58-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-64-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-67-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-17-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-15-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-5-0x0000000002170000-0x0000000002171000-memory.dmp

          Filesize

          4KB

        • memory/1208-138-0x0000000077996000-0x0000000077997000-memory.dmp

          Filesize

          4KB

        • memory/1208-13-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-14-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-12-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-11-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-7-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-9-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-10-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/2040-8-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/2040-1-0x0000000001AC0000-0x0000000001AC7000-memory.dmp

          Filesize

          28KB

        • memory/2040-0-0x0000000140000000-0x00000001401F7000-memory.dmp

          Filesize

          2.0MB

        • memory/2956-116-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/3060-84-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB

        • memory/3060-79-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/3060-76-0x0000000140000000-0x00000001401F8000-memory.dmp

          Filesize

          2.0MB