Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2024 04:12

General

  • Target

    793df85f287f06c4764a229b404e0a7f.dll

  • Size

    660KB

  • MD5

    793df85f287f06c4764a229b404e0a7f

  • SHA1

    454ad7fe4ede68aeffa2144dc95d22618a17a17e

  • SHA256

    823691284d6b7786dee73b7315b3cd146eac4160d5f7fca663cab821b66698fa

  • SHA512

    e20fce0797127f695247109fa01d39db3304fee14aa34441cc5f88c3ea38c18bf8d013b2207c57dd56b542dc9eaee0100a3c3c58c326be54677e760dd7f50c9f

  • SSDEEP

    6144:Z34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:ZIKp/UWCZdCDh2IZDwAFRpR6Au

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 11 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\793df85f287f06c4764a229b404e0a7f.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1220
  • C:\Windows\system32\winlogon.exe
    C:\Windows\system32\winlogon.exe
    1⤵
      PID:2596
    • C:\Users\Admin\AppData\Local\AUyx93Rp\winlogon.exe
      C:\Users\Admin\AppData\Local\AUyx93Rp\winlogon.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1252
    • C:\Windows\system32\msra.exe
      C:\Windows\system32\msra.exe
      1⤵
        PID:2536
      • C:\Users\Admin\AppData\Local\v544g\msra.exe
        C:\Users\Admin\AppData\Local\v544g\msra.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1380
      • C:\Windows\system32\sethc.exe
        C:\Windows\system32\sethc.exe
        1⤵
          PID:308
        • C:\Users\Admin\AppData\Local\ZlJ5xMj\sethc.exe
          C:\Users\Admin\AppData\Local\ZlJ5xMj\sethc.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1788

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\AUyx93Rp\WINSTA.dll

          Filesize

          668KB

          MD5

          0f7b1cd42cb3008b513c68b61cd3edac

          SHA1

          dad4038551566471c408d0c467aa8df5efd02fb2

          SHA256

          eaa3e3df2d903a176a9ba47bd617c5a9dbbfc910e076ab5f0f6ae436418fd0f4

          SHA512

          56c0b2ec7a68ea554235d6cf9634dabaf5aa9f7fbc57011c70d96e5f7aabdf14d32676a72d07cd779b01789c19a72131d424aac083841a8e1920e2fa8fc3e519

        • C:\Users\Admin\AppData\Local\v544g\UxTheme.dll

          Filesize

          664KB

          MD5

          677dc45dd6238854f18e3c9e75348af4

          SHA1

          c6424a702fc06e551b390aa38f4547608c1a748d

          SHA256

          543e9c0a6dc3515494a173d16fa8118d8503800cbb25c165f0b4e7c7dea01c4d

          SHA512

          d09e0fa1b44a34b86546d36e56943647d4eb27ae7aa8fc2679ef7079dd38e8e6fe29f2142877e23e1b2fdb3bd08158ce281bf5bd28d22ddedfbed55ec0dfc204

        • C:\Users\Admin\AppData\Local\v544g\msra.exe

          Filesize

          636KB

          MD5

          e79df53bad587e24b3cf965a5746c7b6

          SHA1

          87a97ec159a3fc1db211f3c2c62e4d60810e7a70

          SHA256

          4e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d

          SHA512

          9a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

          Filesize

          1KB

          MD5

          451d3c5dbfe045f7047207e8a48c2e28

          SHA1

          5cb9a8ea1a705bb69520cea6300b2a79ba476dce

          SHA256

          1d77f0898c66bc0a2723911e2492c6b57f8b29e5f6b84f90aedca50b0f50eb5d

          SHA512

          19afaec36d2dcca0160d3049aeead04ae9177981f2d76be52d523d3a128ccf03d666073dd8d7794f9cf7dc3eec7655bc1836e74fb8b9d8945d5cb5f4e97f514e

        • \Users\Admin\AppData\Local\AUyx93Rp\winlogon.exe

          Filesize

          381KB

          MD5

          1151b1baa6f350b1db6598e0fea7c457

          SHA1

          434856b834baf163c5ea4d26434eeae775a507fb

          SHA256

          b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49

          SHA512

          df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab

        • \Users\Admin\AppData\Local\ZlJ5xMj\OLEACC.dll

          Filesize

          664KB

          MD5

          d292aac9f1b55a652fbd9f2743d27659

          SHA1

          268cf9c4a0258371a1705e068d1adeaf5c80c333

          SHA256

          9399d8785a4da618530d08c1c67f7409a048e27788d24c196776c9f7effd2c26

          SHA512

          4128188f00c0ac441cd053b52d88ddf06cb6ac55e234c8c934e24c67a17295df9a110bca77cab410e4226c19a824951d5695840bcefefb5718962d6405bbb40b

        • \Users\Admin\AppData\Local\ZlJ5xMj\sethc.exe

          Filesize

          272KB

          MD5

          3bcb70da9b5a2011e01e35ed29a3f3f3

          SHA1

          9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

          SHA256

          dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

          SHA512

          69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

        • memory/1200-33-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-23-0x0000000077770000-0x0000000077772000-memory.dmp

          Filesize

          8KB

        • memory/1200-7-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-12-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-13-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-15-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-14-0x0000000002B40000-0x0000000002B47000-memory.dmp

          Filesize

          28KB

        • memory/1200-22-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-24-0x00000000777A0000-0x00000000777A2000-memory.dmp

          Filesize

          8KB

        • memory/1200-10-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-34-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-4-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1200-68-0x0000000077406000-0x0000000077407000-memory.dmp

          Filesize

          4KB

        • memory/1200-9-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-11-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-8-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-6-0x0000000140000000-0x00000001400A5000-memory.dmp

          Filesize

          660KB

        • memory/1200-3-0x0000000077406000-0x0000000077407000-memory.dmp

          Filesize

          4KB

        • memory/1220-0-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/1220-1-0x000007FEF6C70000-0x000007FEF6D15000-memory.dmp

          Filesize

          660KB

        • memory/1220-42-0x000007FEF6C70000-0x000007FEF6D15000-memory.dmp

          Filesize

          660KB

        • memory/1252-50-0x000007FEF6D20000-0x000007FEF6DC7000-memory.dmp

          Filesize

          668KB

        • memory/1252-55-0x000007FEF6D20000-0x000007FEF6DC7000-memory.dmp

          Filesize

          668KB

        • memory/1252-52-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/1380-70-0x0000000000420000-0x0000000000427000-memory.dmp

          Filesize

          28KB

        • memory/1380-73-0x000007FEF66D0000-0x000007FEF6776000-memory.dmp

          Filesize

          664KB

        • memory/1380-67-0x000007FEF66D0000-0x000007FEF6776000-memory.dmp

          Filesize

          664KB

        • memory/1788-86-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/1788-90-0x000007FEF66D0000-0x000007FEF6776000-memory.dmp

          Filesize

          664KB