Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 10:34

General

  • Target

    7477fc39b45ddb88b4ff0de5a954889a.dll

  • Size

    1.8MB

  • MD5

    7477fc39b45ddb88b4ff0de5a954889a

  • SHA1

    b89770175d0845d1aa7615fc346bcf6d9dd755ea

  • SHA256

    1bed54ab01a098e8eefee909a56a0ce2b4ffc50208869d313501680c11e05798

  • SHA512

    f4369eb6c97714d9409f67598022fab36555405a4b4a2fcac31b8b8a631a19280c0204e32bd9c46a33d44a77c31134f129e3b7295dfc0c6470c612e62b352296

  • SSDEEP

    12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Kt:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnbKt

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7477fc39b45ddb88b4ff0de5a954889a.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4488
  • C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
    C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
    1⤵
      PID:3616
    • C:\Users\Admin\AppData\Local\eGcMl\PasswordOnWakeSettingFlyout.exe
      C:\Users\Admin\AppData\Local\eGcMl\PasswordOnWakeSettingFlyout.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3884
    • C:\Windows\system32\OptionalFeatures.exe
      C:\Windows\system32\OptionalFeatures.exe
      1⤵
        PID:3880
      • C:\Users\Admin\AppData\Local\6ndyrWFGr\OptionalFeatures.exe
        C:\Users\Admin\AppData\Local\6ndyrWFGr\OptionalFeatures.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3876
      • C:\Windows\system32\cmstp.exe
        C:\Windows\system32\cmstp.exe
        1⤵
          PID:2384
        • C:\Users\Admin\AppData\Local\8o9\cmstp.exe
          C:\Users\Admin\AppData\Local\8o9\cmstp.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3348

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\6ndyrWFGr\OptionalFeatures.exe

          Filesize

          110KB

          MD5

          d6cd8bef71458804dbc33b88ace56372

          SHA1

          a18b58445be2492c5d37abad69b5aa0d29416a60

          SHA256

          fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8

          SHA512

          1bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d

        • C:\Users\Admin\AppData\Local\6ndyrWFGr\appwiz.cpl

          Filesize

          1.8MB

          MD5

          1e975a810a1010763c4ef98476955171

          SHA1

          3ea2206a4dd2139d2b024c7c9f4b0a88c803b370

          SHA256

          076a0adc4110fe04316bc651cd4126bab6c32492808799a27acb15c4fb7d002d

          SHA512

          acc180480e2cfd8ac2d22e16d9317e41e8009a0e4721547b119eae26b2a4809fec2ea558a31b5b8e8420a8b304f2429cff2d63a4542345df134cd1bacb22795f

        • C:\Users\Admin\AppData\Local\8o9\VERSION.dll

          Filesize

          1.8MB

          MD5

          9ecc2bc6779cae37cfff6282dbec4a7a

          SHA1

          e82b199fba7a58953e6cc4b1f9af252a3a516e97

          SHA256

          367ad3c11f6e4cf326f01efcc53271622af851d4bc16baeb6136dbee5a1ac231

          SHA512

          99d3c18cf1e9096a1cc458ae5fe36b01a338de7105b280409206ecb0f9a681ce3e9d330e712111e29230eee5090df33f55aa3f6cd6f29fe7b41deea3d532fe86

        • C:\Users\Admin\AppData\Local\8o9\cmstp.exe

          Filesize

          96KB

          MD5

          4cc43fe4d397ff79fa69f397e016df52

          SHA1

          8fd6cf81ad40c9b123cd75611860a8b95c72869c

          SHA256

          f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c

          SHA512

          851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157

        • C:\Users\Admin\AppData\Local\eGcMl\PasswordOnWakeSettingFlyout.exe

          Filesize

          44KB

          MD5

          591a98c65f624c52882c2b238d6cd4c4

          SHA1

          c960d08c19d777069cf265dcc281807fbd8502d7

          SHA256

          5e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06

          SHA512

          1999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074

        • C:\Users\Admin\AppData\Local\eGcMl\UxTheme.dll

          Filesize

          1.8MB

          MD5

          dd3d42654d5f0a2160f50089ada77961

          SHA1

          60ce289ee7e076688b1e74ef7c459cafba44987f

          SHA256

          2d051fca8b065f47662cab970fab271145aa8d1086d82f87d0cd7ad75044321e

          SHA512

          45f04399ebfb5bbc2e5fa13b7181630cc3d98c6e3a1d005305410d924fd137653547f3b505601462b7d7035c20fc7cb798876b65c066aa853a22a929a0e06202

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          6dc4ebc4985c890b24ca556dcac9798f

          SHA1

          cf3d795cd026bf5316a7c24630bae5f08a4df1bd

          SHA256

          b9e35a0df8428f3c3f8cbb05f26f45fad317c57b9e4606a3317fc13c116fdc86

          SHA512

          88c104335e70e72a17d776ae97844b10ffc6ef06312db20afccae75c46c2552b571ee086bd3ae28a7d3f6f8bb86b0e250b77003a6527c04941b893429b45e266

        • memory/3348-117-0x000001A309BF0000-0x000001A309BF7000-memory.dmp

          Filesize

          28KB

        • memory/3464-38-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-43-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-17-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-16-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-18-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-19-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-21-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-20-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-22-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-23-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-24-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-25-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-27-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-28-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-26-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-29-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-30-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-31-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-32-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-33-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-34-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-35-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-36-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-37-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-4-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

          Filesize

          4KB

        • memory/3464-39-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-40-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-41-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-42-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-15-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-44-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-45-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-46-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-47-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-49-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-48-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-50-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-51-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-52-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-53-0x00000000008B0000-0x00000000008B7000-memory.dmp

          Filesize

          28KB

        • memory/3464-60-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-61-0x00007FFCAC400000-0x00007FFCAC410000-memory.dmp

          Filesize

          64KB

        • memory/3464-70-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-72-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-14-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-11-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-5-0x00007FFCAA4BA000-0x00007FFCAA4BB000-memory.dmp

          Filesize

          4KB

        • memory/3464-9-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-13-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-12-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-7-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3464-10-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/3876-99-0x000001A0E0830000-0x000001A0E0837000-memory.dmp

          Filesize

          28KB

        • memory/3884-81-0x00000255148A0000-0x00000255148A7000-memory.dmp

          Filesize

          28KB

        • memory/3884-82-0x0000000140000000-0x00000001401C7000-memory.dmp

          Filesize

          1.8MB

        • memory/4488-1-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB

        • memory/4488-0-0x0000019E7D6C0000-0x0000019E7D6C7000-memory.dmp

          Filesize

          28KB

        • memory/4488-8-0x0000000140000000-0x00000001401C6000-memory.dmp

          Filesize

          1.8MB