Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2024 12:18

General

  • Target

    7a3a76153e2caa54fc663d0fdc121d17.dll

  • Size

    1.6MB

  • MD5

    7a3a76153e2caa54fc663d0fdc121d17

  • SHA1

    328a9e052e7a779cb70145f52761fe95ce11f2a1

  • SHA256

    4566f8ee1f24d26293566ff8f5bd093244cd716536def070a0cc36ef83be64dd

  • SHA512

    29dc194e0f6ab90c2eb34c5d989b15ac4950dca13cb3ab8eafcbfa1ac7fc5d108ee9090d25abca1be31633aa6ed0df2cf7369f7855c66f0f952d975d3f8619fd

  • SSDEEP

    12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a3a76153e2caa54fc663d0fdc121d17.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2128
  • C:\Windows\system32\javaws.exe
    C:\Windows\system32\javaws.exe
    1⤵
      PID:1876
    • C:\Users\Admin\AppData\Local\ZXcjph763\javaws.exe
      C:\Users\Admin\AppData\Local\ZXcjph763\javaws.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:108
    • C:\Windows\system32\sethc.exe
      C:\Windows\system32\sethc.exe
      1⤵
        PID:1668
      • C:\Users\Admin\AppData\Local\F27T8lB6\sethc.exe
        C:\Users\Admin\AppData\Local\F27T8lB6\sethc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2416
      • C:\Windows\system32\DevicePairingWizard.exe
        C:\Windows\system32\DevicePairingWizard.exe
        1⤵
          PID:1008
        • C:\Users\Admin\AppData\Local\scHWaI\DevicePairingWizard.exe
          C:\Users\Admin\AppData\Local\scHWaI\DevicePairingWizard.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1868

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\F27T8lB6\UxTheme.dll

          Filesize

          1.6MB

          MD5

          d45923380cf0b736c95c326d8845be2c

          SHA1

          47942b70d41a0b0b306e57cbc4ae29f7e02ff49c

          SHA256

          23c73de36853df35eef8557a562dc503689ab8ec1589d66f515dd5333a8c4722

          SHA512

          a58b16c27e234987d788be245b080cb5432f16d093bc6877af28eef18dec158335d305cf8c9719f1fde2c9e15ac13d374247daa1514e40aefbc1a23b60a5ac8d

        • C:\Users\Admin\AppData\Local\F27T8lB6\sethc.exe

          Filesize

          272KB

          MD5

          3bcb70da9b5a2011e01e35ed29a3f3f3

          SHA1

          9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

          SHA256

          dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

          SHA512

          69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

        • C:\Users\Admin\AppData\Local\ZXcjph763\VERSION.dll

          Filesize

          1.6MB

          MD5

          2c967f8c59ea31ab67599cde387021c8

          SHA1

          658154c8ee1bdc4185387c5918a3287fa0a4622a

          SHA256

          98f96dbd1de8d8cb8991368eb151b9af6139a437e8bd3a93a0e560a227429f23

          SHA512

          f8289d2b15005d41671d3ee712c56e2991c5d7cd57cbf646d33818061eccfbf6e27b43091905053213ea9a86e79e23fdbf0ba4a8980e2a608f05ac756a3a7fbf

        • C:\Users\Admin\AppData\Local\scHWaI\MFC42u.dll

          Filesize

          1.6MB

          MD5

          8519c97c3cd05e5e55581d631ae539c1

          SHA1

          d1c3808f6a628d3d7bf30313ffede54f9674354b

          SHA256

          909d6411e607254e2ce85b3e48e533a5af8173ab601970bf4493e190437e1541

          SHA512

          d82c9566d44917e37a570861c450cc4c0e8fa7450ed321c2ef74e0c49c06dbe738f432f58c3e3b9159ab5df4547b85929d17c3323bdad87332473ac1dc4582c0

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zrkibbhbsqvuoso.lnk

          Filesize

          1KB

          MD5

          af359e2071289bc6d671dd025a79e93b

          SHA1

          dd163a0e769e8735258773909f74ec62b1e063ef

          SHA256

          f177200030cb24a557068d1843649454a8fb9fe06e986fab5f75c56b5a66ad4c

          SHA512

          a10782e0c95930b696d42a04a7818fd923a5353e038410344424d45be81ef7401b0ea72097c596c38566685c588020500973e0c548ebe17b46e5965c869c8fa0

        • \Users\Admin\AppData\Local\ZXcjph763\javaws.exe

          Filesize

          312KB

          MD5

          f94bc1a70c942621c4279236df284e04

          SHA1

          8f46d89c7db415a7f48ccd638963028f63df4e4f

          SHA256

          be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c

          SHA512

          60edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52

        • \Users\Admin\AppData\Local\scHWaI\DevicePairingWizard.exe

          Filesize

          73KB

          MD5

          9728725678f32e84575e0cd2d2c58e9b

          SHA1

          dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c

          SHA256

          d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544

          SHA512

          a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377

        • memory/108-85-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/1276-42-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-51-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-19-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-20-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-16-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-21-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-22-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-23-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-24-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-28-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-30-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-31-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-29-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-36-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-35-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-37-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-34-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-38-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-32-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-39-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-33-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-26-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-40-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-27-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-14-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-43-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-45-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-49-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-53-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-18-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-55-0x0000000002B40000-0x0000000002B47000-memory.dmp

          Filesize

          28KB

        • memory/1276-52-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-50-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-48-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-47-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-61-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-46-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-62-0x0000000077321000-0x0000000077322000-memory.dmp

          Filesize

          4KB

        • memory/1276-44-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-41-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-25-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-17-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-13-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-12-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-63-0x0000000077480000-0x0000000077482000-memory.dmp

          Filesize

          8KB

        • memory/1276-66-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-15-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-11-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-10-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-9-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1276-144-0x0000000077116000-0x0000000077117000-memory.dmp

          Filesize

          4KB

        • memory/1276-4-0x0000000077116000-0x0000000077117000-memory.dmp

          Filesize

          4KB

        • memory/1276-5-0x0000000002B70000-0x0000000002B71000-memory.dmp

          Filesize

          4KB

        • memory/1276-7-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/2128-8-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/2128-1-0x0000000000130000-0x0000000000137000-memory.dmp

          Filesize

          28KB

        • memory/2128-0-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/2416-102-0x0000000000330000-0x0000000000337000-memory.dmp

          Filesize

          28KB