Analysis

  • max time kernel
    152s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2024 20:54

General

  • Target

    785ce10521b549ee5b635b6aaebf7f7f.dll

  • Size

    1.6MB

  • MD5

    785ce10521b549ee5b635b6aaebf7f7f

  • SHA1

    abe7c72eef2d7414f84b0ff9811cfea344a35078

  • SHA256

    2841518b5acc66a9fdbea00ba90c5775124fca822a3ae725b7dc86d68bfe4689

  • SHA512

    eeb6d2c24914bef11cd8e74a1703fd65dda1d9d3fedf78bc9958c970ab69c28fd7d9963300fecc5d0076e082516d275ae8213a3cdfeb085d744b25bd447fb525

  • SSDEEP

    12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\785ce10521b549ee5b635b6aaebf7f7f.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2428
  • C:\Windows\system32\SystemPropertiesProtection.exe
    C:\Windows\system32\SystemPropertiesProtection.exe
    1⤵
      PID:864
    • C:\Users\Admin\AppData\Local\jvy\SystemPropertiesProtection.exe
      C:\Users\Admin\AppData\Local\jvy\SystemPropertiesProtection.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4532
    • C:\Windows\system32\Magnify.exe
      C:\Windows\system32\Magnify.exe
      1⤵
        PID:636
      • C:\Users\Admin\AppData\Local\sr19H\Magnify.exe
        C:\Users\Admin\AppData\Local\sr19H\Magnify.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4936
      • C:\Windows\system32\unregmp2.exe
        C:\Windows\system32\unregmp2.exe
        1⤵
          PID:2064
        • C:\Users\Admin\AppData\Local\VmImW0n4T\unregmp2.exe
          C:\Users\Admin\AppData\Local\VmImW0n4T\unregmp2.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1380

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\VmImW0n4T\VERSION.dll

          Filesize

          1.6MB

          MD5

          f5b89e13278cbc8bb4eda6b6a65acd49

          SHA1

          2a31a6d51d8db015713113f6937f2263b801368e

          SHA256

          b64ed8b5e6cbc720ce824bea0ae48e1ef9851501c99617a651ea39962371dc40

          SHA512

          6fbc016d6f18b1d5c00f58ce7694da194969621285687b227308d96399c0a856fe0d7f8a91e3c030be8e1b87a4da1454e2237196b4d02826cb8f55c8fecc93fb

        • C:\Users\Admin\AppData\Local\VmImW0n4T\unregmp2.exe

          Filesize

          259KB

          MD5

          a6fc8ce566dec7c5873cb9d02d7b874e

          SHA1

          a30040967f75df85a1e3927bdce159b102011a61

          SHA256

          21f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d

          SHA512

          f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc

        • C:\Users\Admin\AppData\Local\jvy\SYSDM.CPL

          Filesize

          1.6MB

          MD5

          4687de80f22c03b182cd5eaa50fd7547

          SHA1

          0cd5e596ef4a0a7f7f19878c6ceedb5288e71d06

          SHA256

          ff14a9e36a7e4b88cc53ef1150a1a897e41936947f8acd3076a0758380def005

          SHA512

          57771a509fffce35de8b0686528ff2852539c27b14663acb5d7546b9ee14df5d8b0a69126aa142dfc5496d10052a3bb20223d8909a7ba5c0c01002436135e4e1

        • C:\Users\Admin\AppData\Local\jvy\SystemPropertiesProtection.exe

          Filesize

          82KB

          MD5

          26640d2d4fa912fc9a354ef6cfe500ff

          SHA1

          a343fd82659ce2d8de3beb587088867cf2ab8857

          SHA256

          a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37

          SHA512

          26162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc

        • C:\Users\Admin\AppData\Local\sr19H\MAGNIFICATION.dll

          Filesize

          1.6MB

          MD5

          b8b52c9e3c69c8de33ad11d612750590

          SHA1

          c2728c121a80fd03e75c1c4fd75dae89d9817ddf

          SHA256

          30f688aff1efced9538ce4f663de74f55c2525d81d93103aefeaa620077f570e

          SHA512

          037a736a4ec06b40c1d4a7a0fb11afeaf6134da4c9a53d92e34e1239d617b4bc4f98a1139a4aca2543a067e81ea4195295c583833da40ba225fe8eb5826da609

        • C:\Users\Admin\AppData\Local\sr19H\Magnify.exe

          Filesize

          639KB

          MD5

          4029890c147e3b4c6f41dfb5f9834d42

          SHA1

          10d08b3f6dabe8171ca2dd52e5737e3402951c75

          SHA256

          57137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d

          SHA512

          dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          32faeb7a0ba72a4f700326c6e8f5d3b3

          SHA1

          005395b4585649b331888953560da24517623ad8

          SHA256

          de71595fd4a6d05503a7cb0161139db6bf1ff23a4c922eb841b71a7e13c3955b

          SHA512

          cde5a8e50d0d0967fd9f30f4a021ff3164018ad42d7e2f089a79ff95399aacef5a9eb3be9505a40ca1e6892e91ea3677f168bb3056bf1f324ebd8812a73b7cc9

        • memory/1380-106-0x000002754C280000-0x000002754C287000-memory.dmp

          Filesize

          28KB

        • memory/1380-111-0x0000000140000000-0x000000014019E000-memory.dmp

          Filesize

          1.6MB

        • memory/2428-9-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/2428-0-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/2428-2-0x00000177991B0000-0x00000177991B7000-memory.dmp

          Filesize

          28KB

        • memory/2428-1-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-29-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-38-0x0000000001350000-0x0000000001357000-memory.dmp

          Filesize

          28KB

        • memory/3520-18-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-19-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-20-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-21-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-22-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-23-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-24-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-25-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-27-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-26-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-28-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-16-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-30-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-31-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-32-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-34-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-35-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-36-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-37-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-15-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-33-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-45-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-48-0x00007FFE789A0000-0x00007FFE789B0000-memory.dmp

          Filesize

          64KB

        • memory/3520-55-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-57-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-17-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-14-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-5-0x0000000002E20000-0x0000000002E21000-memory.dmp

          Filesize

          4KB

        • memory/3520-6-0x00007FFE77E5A000-0x00007FFE77E5B000-memory.dmp

          Filesize

          4KB

        • memory/3520-8-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-13-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-10-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-11-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/3520-12-0x0000000140000000-0x000000014019D000-memory.dmp

          Filesize

          1.6MB

        • memory/4532-73-0x0000000140000000-0x000000014019E000-memory.dmp

          Filesize

          1.6MB

        • memory/4532-69-0x0000022F358A0000-0x0000022F358A7000-memory.dmp

          Filesize

          28KB

        • memory/4532-66-0x0000000140000000-0x000000014019E000-memory.dmp

          Filesize

          1.6MB

        • memory/4936-90-0x0000000140000000-0x000000014019E000-memory.dmp

          Filesize

          1.6MB

        • memory/4936-85-0x000002A6CE920000-0x000002A6CE927000-memory.dmp

          Filesize

          28KB