Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2024 05:49

General

  • Target

    73e4b574f7a058d63f9b35f74580a338.dll

  • Size

    2.0MB

  • MD5

    73e4b574f7a058d63f9b35f74580a338

  • SHA1

    4abd585b62be4d0a8efbd763891772521390c3f6

  • SHA256

    d8ae9023a64efcbaf60e37647a920cf6757fa96a6e1e7357d67a3ac970c86eca

  • SHA512

    4e9aa099ae2b51d59db1818768b34662b8b812fdd37a26aa72bb7994b3219b34d1f0e14902154ae5c51eade8bdcf5bb0da7aa48fe23f7ca6de3c36974b4f5d97

  • SSDEEP

    12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1L:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\73e4b574f7a058d63f9b35f74580a338.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2912
  • C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    1⤵
      PID:592
    • C:\Users\Admin\AppData\Local\XLifyUm\wermgr.exe
      C:\Users\Admin\AppData\Local\XLifyUm\wermgr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:472
    • C:\Windows\system32\rstrui.exe
      C:\Windows\system32\rstrui.exe
      1⤵
        PID:900
      • C:\Users\Admin\AppData\Local\xjKeJ62\rstrui.exe
        C:\Users\Admin\AppData\Local\xjKeJ62\rstrui.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:832
      • C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
        C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
        1⤵
          PID:2724
        • C:\Users\Admin\AppData\Local\7uGmjl\SystemPropertiesDataExecutionPrevention.exe
          C:\Users\Admin\AppData\Local\7uGmjl\SystemPropertiesDataExecutionPrevention.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2984

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\7uGmjl\SYSDM.CPL

          Filesize

          2.0MB

          MD5

          4d7898b5c400a1cda32132e97e4f0fd8

          SHA1

          067df1856188c2723795a4dc6a33c0986d4b05eb

          SHA256

          8a35965c5853e73e12e2e2d984dc925cefef77f5b210af628c95a49ae6409482

          SHA512

          49b6c484bcb8b329acfe111094ed1b115175714e67118123f504e79c3b2adad17005621783f23e0e0b9e59991ed9bdfed865d692e84b91607997a027074645f5

        • C:\Users\Admin\AppData\Local\XLifyUm\wer.dll

          Filesize

          896KB

          MD5

          d9a378b4f5fb16a14724aa1ccc404938

          SHA1

          1511dea6cd032488cdfb7e458adfee99ec2f552b

          SHA256

          dad49aea079a2ac37d3da85e977dc4dd865594ad64e52bdf7cea2be2382f477a

          SHA512

          bfaa037331de080eb6cd89bc45fc8dc97c391a96d1d88662d7eac2951593d5cab958a39c74567b90608cf2cbb16f93e8fe782e174210fa0dbc25c41effcc3e22

        • C:\Users\Admin\AppData\Local\XLifyUm\wermgr.exe

          Filesize

          49KB

          MD5

          41df7355a5a907e2c1d7804ec028965d

          SHA1

          453263d230c6317eb4a2eb3aceeec1bbcf5e153d

          SHA256

          207bfec939e7c017c4704ba76172ee2c954f485ba593bc1bc8c7666e78251861

          SHA512

          59c9d69d3942543af4f387137226516adec1a4304bd5696c6c1d338f9e5f40d136450907351cce018563df1358e06a792005167f5c08c689df32d809c4cebdcf

        • C:\Users\Admin\AppData\Local\xjKeJ62\rstrui.exe

          Filesize

          290KB

          MD5

          3db5a1eace7f3049ecc49fa64461e254

          SHA1

          7dc64e4f75741b93804cbae365e10dc70592c6a9

          SHA256

          ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49

          SHA512

          ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          d63ce2369919ec7fc9e45ea777e80bfd

          SHA1

          d6c55ed701aa22cbb19094f49e2f1a935d014be3

          SHA256

          26db2f7976ae3bc3432af7508ae271c09f1b8ed4ec9c0b4398ca66ca0850d828

          SHA512

          9b2ecc840f2a5435f3a3e9e660c9ef9c342ae260aaed6e728a1857e2221f5bb985378413f4e597b46d6eb7cec3701c664b4c92d23ebf06da3a333dfd37ff10ef

        • \Users\Admin\AppData\Local\7uGmjl\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          80KB

          MD5

          e43ff7785fac643093b3b16a9300e133

          SHA1

          a30688e84c0b0a22669148fe87680b34fcca2fba

          SHA256

          c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b

          SHA512

          61260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a

        • \Users\Admin\AppData\Local\XLifyUm\wer.dll

          Filesize

          2.0MB

          MD5

          831fa0fe191640a1bc81189c5c968840

          SHA1

          af019f60c44d8f0d82015ef1ff07ff68e2b2e192

          SHA256

          1b087df372b266660ff9e4ec7b67806fe8141505aa748e29b7c58713c599bf87

          SHA512

          91fde0d1a0922036b3e5012ab2215d24dcef91b236d0d36bc27281a3fb1fde617df094a411506e000920041c9b43d49062ece6a8f3449387a7c467ea00a78129

        • \Users\Admin\AppData\Local\xjKeJ62\SRCORE.dll

          Filesize

          2.0MB

          MD5

          2eb76e230d7e1f6c60065648223eaed3

          SHA1

          f74dddeadd438788e12848fc6e70395ee88a897c

          SHA256

          ea2b6bcb30e8f47ca03385db20bbd7d89db4d553b32727e62de50c06c6daae67

          SHA512

          fa06118bbeed663f6f48d9514c63d065c710815d797e4ba32c60fe4d059a43aad45b67ef73a7ca1f88cca27d94afc3ec15d8810ffe8314135895a0669886a23f

        • memory/472-78-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/472-79-0x0000000140000000-0x0000000140204000-memory.dmp

          Filesize

          2.0MB

        • memory/832-97-0x0000000000280000-0x0000000000287000-memory.dmp

          Filesize

          28KB

        • memory/1260-35-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-40-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-19-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-22-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-21-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-20-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-23-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-28-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-27-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-26-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-25-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-24-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-29-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-31-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-32-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-30-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-37-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-38-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-36-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-4-0x00000000775A6000-0x00000000775A7000-memory.dmp

          Filesize

          4KB

        • memory/1260-33-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-34-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-42-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-43-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-41-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-18-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-39-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-44-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-46-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-45-0x0000000001D40000-0x0000000001D47000-memory.dmp

          Filesize

          28KB

        • memory/1260-53-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-54-0x00000000777B1000-0x00000000777B2000-memory.dmp

          Filesize

          4KB

        • memory/1260-57-0x0000000077910000-0x0000000077912000-memory.dmp

          Filesize

          8KB

        • memory/1260-60-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-64-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-14-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-15-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-17-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-16-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-12-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-13-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-7-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-9-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-10-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-11-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/1260-5-0x0000000002B10000-0x0000000002B11000-memory.dmp

          Filesize

          4KB

        • memory/1260-134-0x00000000775A6000-0x00000000775A7000-memory.dmp

          Filesize

          4KB

        • memory/2912-8-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/2912-1-0x0000000140000000-0x0000000140203000-memory.dmp

          Filesize

          2.0MB

        • memory/2912-0-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/2984-116-0x0000000000080000-0x0000000000087000-memory.dmp

          Filesize

          28KB