Resubmissions

11-02-2024 10:09

240211-l6zqlafa8x 10

26-01-2024 22:07

240126-116dhsfch6 10

Analysis

  • max time kernel
    151s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-01-2024 22:07

General

  • Target

    78833dc80091e76f426f64b576358fef.dll

  • Size

    1.9MB

  • MD5

    78833dc80091e76f426f64b576358fef

  • SHA1

    73bf7b969ae33dfbf064bd0ae6eba9e5caf12a49

  • SHA256

    c004c89e8e9190bf7629831fa4b9f1a6a90510777e4d233e119b0f4902f66222

  • SHA512

    083b730c34431022a4cea13721af99a789820de1b135a9eff815bbe7a7a8f4e7162576c3c821fb781a2366ab78d83c5382744de3a032b3af02e3db2320557a28

  • SSDEEP

    12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Mt:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnbMt

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\78833dc80091e76f426f64b576358fef.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2008
  • C:\Windows\system32\FXSCOVER.exe
    C:\Windows\system32\FXSCOVER.exe
    1⤵
      PID:1348
    • C:\Users\Admin\AppData\Local\bIrnq\FXSCOVER.exe
      C:\Users\Admin\AppData\Local\bIrnq\FXSCOVER.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:328
    • C:\Windows\system32\SoundRecorder.exe
      C:\Windows\system32\SoundRecorder.exe
      1⤵
        PID:2952
      • C:\Users\Admin\AppData\Local\LEpoW9c\SoundRecorder.exe
        C:\Users\Admin\AppData\Local\LEpoW9c\SoundRecorder.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1556
      • C:\Windows\system32\shrpubw.exe
        C:\Windows\system32\shrpubw.exe
        1⤵
          PID:1608
        • C:\Users\Admin\AppData\Local\UP5b0FH\shrpubw.exe
          C:\Users\Admin\AppData\Local\UP5b0FH\shrpubw.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2776

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\LEpoW9c\SoundRecorder.exe

          Filesize

          139KB

          MD5

          47f0f526ad4982806c54b845b3289de1

          SHA1

          8420ea488a2e187fe1b7fcfb53040d10d5497236

          SHA256

          e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b

          SHA512

          4c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d

        • C:\Users\Admin\AppData\Local\LEpoW9c\UxTheme.dll

          Filesize

          681KB

          MD5

          a1aa25aaea41d5d9a7e89cb3ae46eb18

          SHA1

          ed1c6b6b57b3becca6ade3e0e7207136fd74e945

          SHA256

          e6a6d24d94345ae6ebb1e9f02deee40037a7d317dd4ea97c551b2947bc553aee

          SHA512

          417ceadc05c2caa1608efafd8a3b36ff24d4b3ac523aa7c7afaa96759be856e09183820aec80c60fc4eb5bace829cf205a70604d7d6e5ced7007db1e4b89f7ba

        • C:\Users\Admin\AppData\Local\UP5b0FH\srvcli.dll

          Filesize

          2.0MB

          MD5

          5a0c00a044d0dff1751584ba329f5c78

          SHA1

          f30974d22b803ddcf0bb3aa259683521f39578e0

          SHA256

          0e9d228489beef2847e2c83ab31c8c4f4fa7a3fd1e917042ea8c5abee9bbf915

          SHA512

          fe895a6b7e03fa0df934d412210c93bf58cff8c070330b0a9ebf8402c01686b5b5097699bf60d88becc61edb8112b8a0d85ed197dd7bec1e99500d71066b1d11

        • C:\Users\Admin\AppData\Local\bIrnq\FXSCOVER.exe

          Filesize

          261KB

          MD5

          5e2c61be8e093dbfe7fc37585be42869

          SHA1

          ed46cda4ece3ef187b0cf29ca843a6c6735af6c0

          SHA256

          3d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121

          SHA512

          90bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b

        • C:\Users\Admin\AppData\Local\bIrnq\MFC42u.dll

          Filesize

          1.6MB

          MD5

          95f8e292be0e547be7c164d2862836c0

          SHA1

          7e587c8e804270cd9b165b74369fe570a5d1a581

          SHA256

          a632ba150ead8eba38a109f839c1fd6b9bb4192eb2aabab3b096b928ad5efbcb

          SHA512

          d33dccb872143aad15e7db5e525c99cbfea4565b28f44176c9641be7c56b35e726e232ba2bf2d72123f0fc00371000264e380b1910fdc24ba215bc836918f3a0

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hbeids.lnk

          Filesize

          1KB

          MD5

          dee39ad5768114b7a77ea105be56a120

          SHA1

          3f3916c8070f8c25db6d4d372a4b3ab41b6eb2ec

          SHA256

          1a00a7ab2bb39515707d098f90b5c67354be5ad2c9770f17674526e5c23657cc

          SHA512

          a2545f9936c25d491ce33d2835855314bfc7377f21b4c3119ead4076575fb853ea843865ba7c215825a73807a9c6567c22a85d11932b766866ea9beff9a41b48

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\gx\MFC42u.dll

          Filesize

          2.0MB

          MD5

          758ae7980741f1689e2d4336f0c33096

          SHA1

          a22a928eab901c53e283f4e2266d58993511f6ae

          SHA256

          093cb631c21549f9c79e7fff99e8109b7e8951f8e7b709496beb27ccb9b6cea4

          SHA512

          bbc118159edf3ad6f8c96f09df7d20a8eae9ebc80a5e2b3460d26dbdfd5a2e8a540fbf05815708e8336c08c7d06a4b917c801601118aa2e31583cb381c3270c1

        • \Users\Admin\AppData\Local\LEpoW9c\UxTheme.dll

          Filesize

          2.0MB

          MD5

          4028fff5c8546308e37e2d3eada89545

          SHA1

          d2fff6699841555ba6ba5f7bfbea8b7d4411e92d

          SHA256

          dca70fe8754e0c90943d8ee3fc75c66618b85252b1a7123ea88e73b8fab15938

          SHA512

          e7c78131b3d16828ae14786f8eed1e3711b33c518f90bf2b8955596f0a7161e59e4b4594059fcef9364853358e3eb8b3146d991685cd135e9e9739048000ebd7

        • \Users\Admin\AppData\Local\UP5b0FH\shrpubw.exe

          Filesize

          398KB

          MD5

          29e6d0016611c8f948db5ea71372f76c

          SHA1

          01d007a01020370709cd6580717f9ace049647e8

          SHA256

          53c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930

          SHA512

          300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4

        • \Users\Admin\AppData\Local\bIrnq\MFC42u.dll

          Filesize

          1.2MB

          MD5

          bb61795bd6c8c8c641f4765eb37bcda8

          SHA1

          985921a06688a40046e5791b0d59af3420eb9691

          SHA256

          a82d82db6f65d26b1b9a00278e5ee009adb41b5940eacb2f57292442d91a9db5

          SHA512

          68e743521f9de49798e65fdef046fe24d8602c015464c49caf651736fb801ff4c1a4a0053815fd4a3f2e826ef043ba5ffd1af774d806a27b9b754ccadd3e27f1

        • memory/328-83-0x0000000000080000-0x0000000000087000-memory.dmp

          Filesize

          28KB

        • memory/328-84-0x0000000140000000-0x00000001401FA000-memory.dmp

          Filesize

          2.0MB

        • memory/1224-33-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-45-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-17-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-16-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-23-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-24-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-22-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-26-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-30-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-31-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-29-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-28-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-27-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-25-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-39-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-38-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-37-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-36-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-35-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-34-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-4-0x0000000076F16000-0x0000000076F17000-memory.dmp

          Filesize

          4KB

        • memory/1224-32-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-40-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-42-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-41-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-44-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-43-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-18-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-46-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-47-0x0000000002A60000-0x0000000002A67000-memory.dmp

          Filesize

          28KB

        • memory/1224-54-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-55-0x0000000077121000-0x0000000077122000-memory.dmp

          Filesize

          4KB

        • memory/1224-59-0x0000000077280000-0x0000000077282000-memory.dmp

          Filesize

          8KB

        • memory/1224-65-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-69-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-75-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-19-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-21-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-20-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-15-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-7-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-9-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-10-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-11-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-5-0x0000000002A90000-0x0000000002A91000-memory.dmp

          Filesize

          4KB

        • memory/1224-12-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-14-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-13-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/1224-140-0x0000000076F16000-0x0000000076F17000-memory.dmp

          Filesize

          4KB

        • memory/1556-100-0x0000000000200000-0x0000000000207000-memory.dmp

          Filesize

          28KB

        • memory/2008-8-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/2008-0-0x0000000140000000-0x00000001401F3000-memory.dmp

          Filesize

          1.9MB

        • memory/2008-1-0x0000000000320000-0x0000000000327000-memory.dmp

          Filesize

          28KB

        • memory/2776-118-0x00000000000B0000-0x00000000000B7000-memory.dmp

          Filesize

          28KB