Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2024 10:54

General

  • Target

    772b68bf3048024e686be386fbfe5083.dll

  • Size

    652KB

  • MD5

    772b68bf3048024e686be386fbfe5083

  • SHA1

    458a9a79779cf07157ec419d9511975e2f8aa2c8

  • SHA256

    7c62dc19058fca240cc5e8942a240f7691e6066aa3d59a51185ac3209e8f1409

  • SHA512

    18164714b6ced7284218c0dc8c4e0013b1b08084e07f89322564bdd0bf5d37c62edcb947965e1384e26fe36dd7d613a82697a4429fc935ee1557edf3c9290d62

  • SSDEEP

    12288:8KYQ5LL540CV3UIeLPrleV1F0e8gMA/9L0l3HATpKR4:9YQ5p4f0POF0nkls3opKR

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\772b68bf3048024e686be386fbfe5083.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4040
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe
    1⤵
      PID:4136
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ngA.cmd
      1⤵
        PID:1268
      • C:\Windows\system32\FXSCOVER.exe
        C:\Windows\system32\FXSCOVER.exe
        1⤵
          PID:2140
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\PSg.cmd
          1⤵
          • Drops file in System32 directory
          PID:4768
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /F /TN "Kjaztdntfug" /TR "C:\Windows\system32\KzwGYeZ\FXSCOVER.exe" /SC minute /MO 60 /RL highest
          1⤵
          • Creates scheduled task(s)
          PID:3892
        • C:\Windows\system32\schtasks.exe
          C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
          1⤵
            PID:4348
          • C:\Windows\system32\schtasks.exe
            C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
            1⤵
              PID:1404
            • C:\Windows\system32\schtasks.exe
              C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
              1⤵
                PID:1636
              • C:\Windows\system32\schtasks.exe
                C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
                1⤵
                  PID:3632
                • C:\Windows\system32\schtasks.exe
                  C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
                  1⤵
                    PID:1364
                  • C:\Windows\system32\schtasks.exe
                    C:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"
                    1⤵
                      PID:1124

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\88925.tmp

                      Filesize

                      660KB

                      MD5

                      7e37856e497c97ca21e397d66be195f9

                      SHA1

                      11e348971810c462b5dc59666e2dbdd18bed2799

                      SHA256

                      57fbde9909fd7ee79f54e60e79b9e9c5bf1dbabb832ac125fb73132bc5b1674a

                      SHA512

                      745fc8e5ff68897c20ac80c124e776a8aa1b2fdddb4a87abfd158d824a51a77d289bea9db2d2d617a68e6a34089d2885ff59f83319554ce70180f55a65420883

                    • C:\Users\Admin\AppData\Local\Temp\PSg.cmd

                      Filesize

                      202B

                      MD5

                      2c54eb2c47fd6a2858fa5df349a401ce

                      SHA1

                      f40d125180e681baa872d1cbe0d4f0477d978761

                      SHA256

                      a42fbf0d2ed7b52de4c49c6e5f022df85ead2358f9e22828ce0ec534dfbd2a44

                      SHA512

                      ca194b0eb0cb2f13a1f48f70425130d223bbb0b090d4a013fdec4d49de449382933395c901c30ecf728f1bc2bc4486f5092fc105310629ad7e4a43c1222a09d2

                    • C:\Users\Admin\AppData\Local\Temp\ngA.cmd

                      Filesize

                      225B

                      MD5

                      de7a83ce8e0cc2c0bd6a45dcda94a874

                      SHA1

                      011ec12bc392664c8d94cbb897ebc94021016a68

                      SHA256

                      526a0a6e92bfb44bc2a2b6f878aa139360efc8abf91466b5079d7768298915f8

                      SHA512

                      f9757d8c3dd2382789bbf899a19f22fa23ffc1d88bec9b5bddac28006ac70d645bea0951ca11176d3942e1ac9fd76d9efb05fb7e368c284ff0c375de05f47def

                    • C:\Users\Admin\AppData\Local\Temp\qnB45D.tmp

                      Filesize

                      680KB

                      MD5

                      97c8a57cf4340f43f23b74a2170224e1

                      SHA1

                      55999d97bccc210b7c1ed4dbe34b347b4553c1fd

                      SHA256

                      dc46fff961493ca3e6345a6d401aab9be463d06515f74dcf17f46b6d52ebf5d9

                      SHA512

                      b30c49554c057fa5529668999d596e463b0a2071ae4a140c7612cd9c5cc097eee836b3cb58c128598309d057a66dbc17eaf75959d18a862ba0f3eccd4c27ef86

                    • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tgnmvdx.lnk

                      Filesize

                      876B

                      MD5

                      9f271940ab6a88c7329597b664842af1

                      SHA1

                      75299ba2a987e1986350a0d2c03410b330cad311

                      SHA256

                      4740f076d7720b26e6f2133ae2427d55348285da6892af6f203dc287237b2135

                      SHA512

                      eb1d099d0be8e1daffc7c8700ed24746304708049e4538d110359ef5357797b394ef634e5d5c4b069cfd14116e0d6f5cb3409543e0b22f0af7edd1af214b9e45

                    • C:\Users\Admin\AppData\Roaming\s0mBf\WerFault.exe

                      Filesize

                      555KB

                      MD5

                      5c06542fed8ee68994d43938e7326d75

                      SHA1

                      dd5f35048d912997edb108f80c9d2ce47e3b684a

                      SHA256

                      df42a4557521bacae0d4982ed804762a2815dc157723725a19304632d9b49204

                      SHA512

                      329d8cca981c4f64df112830d69166aa3915c14be794238bcde363127b437c7b149ae91f372ac63f5b772c7d2b1b7591d288e9c2a3ec334839e8466e960eab19

                    • memory/3436-18-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-15-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-21-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-20-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-31-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-25-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-19-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-32-0x00007FF9CBD80000-0x00007FF9CBD90000-memory.dmp

                      Filesize

                      64KB

                    • memory/3436-43-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-41-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-5-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-17-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-16-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-23-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-14-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-13-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-12-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-11-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-9-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-8-0x00007FF9CB3BA000-0x00007FF9CB3BB000-memory.dmp

                      Filesize

                      4KB

                    • memory/3436-7-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-3-0x0000000002070000-0x0000000002071000-memory.dmp

                      Filesize

                      4KB

                    • memory/3436-24-0x0000000000420000-0x0000000000427000-memory.dmp

                      Filesize

                      28KB

                    • memory/3436-22-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/3436-10-0x0000000140000000-0x00000001400A3000-memory.dmp

                      Filesize

                      652KB

                    • memory/4040-0-0x00007FF9BD360000-0x00007FF9BD403000-memory.dmp

                      Filesize

                      652KB

                    • memory/4040-6-0x00007FF9BD360000-0x00007FF9BD403000-memory.dmp

                      Filesize

                      652KB

                    • memory/4040-2-0x0000022E08030000-0x0000022E08037000-memory.dmp

                      Filesize

                      28KB