Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2024 12:18

General

  • Target

    7a3a76153e2caa54fc663d0fdc121d17.dll

  • Size

    1.6MB

  • MD5

    7a3a76153e2caa54fc663d0fdc121d17

  • SHA1

    328a9e052e7a779cb70145f52761fe95ce11f2a1

  • SHA256

    4566f8ee1f24d26293566ff8f5bd093244cd716536def070a0cc36ef83be64dd

  • SHA512

    29dc194e0f6ab90c2eb34c5d989b15ac4950dca13cb3ab8eafcbfa1ac7fc5d108ee9090d25abca1be31633aa6ed0df2cf7369f7855c66f0f952d975d3f8619fd

  • SSDEEP

    12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a3a76153e2caa54fc663d0fdc121d17.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1496
  • C:\Windows\system32\SystemPropertiesAdvanced.exe
    C:\Windows\system32\SystemPropertiesAdvanced.exe
    1⤵
      PID:3508
    • C:\Users\Admin\AppData\Local\rI0CG6efH\SystemPropertiesAdvanced.exe
      C:\Users\Admin\AppData\Local\rI0CG6efH\SystemPropertiesAdvanced.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2556
    • C:\Windows\system32\BitLockerWizardElev.exe
      C:\Windows\system32\BitLockerWizardElev.exe
      1⤵
        PID:2896
      • C:\Users\Admin\AppData\Local\6XTLQ\BitLockerWizardElev.exe
        C:\Users\Admin\AppData\Local\6XTLQ\BitLockerWizardElev.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4856
      • C:\Windows\system32\msra.exe
        C:\Windows\system32\msra.exe
        1⤵
          PID:2880
        • C:\Users\Admin\AppData\Local\LY8KCin\msra.exe
          C:\Users\Admin\AppData\Local\LY8KCin\msra.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3992

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\6XTLQ\BitLockerWizardElev.exe

          Filesize

          100KB

          MD5

          8ac5a3a20cf18ae2308c64fd707eeb81

          SHA1

          31f2f0bdc2eb3e0d2a6cd626ea8ed71262865544

          SHA256

          803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5

          SHA512

          85d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b

        • C:\Users\Admin\AppData\Local\6XTLQ\FVEWIZ.dll

          Filesize

          637KB

          MD5

          0881bd0bb7e90785adf62a7b86a29991

          SHA1

          5da5693401d8704239a841b3fd65214ff0d89544

          SHA256

          f26de7002583374d0f5417351009a371d154e216fc32f961b862076759af671c

          SHA512

          988340e29a7a13c7fb23a77130ef55c28079ffa25428132e8985ca53618640be78c0e95f198edd62f325b2ceeb44444bb9f2e214689fe4b9e6755fcc8b57782c

        • C:\Users\Admin\AppData\Local\6XTLQ\FVEWIZ.dll

          Filesize

          743KB

          MD5

          d129354d26d7079ea15e0fcc8c213fc7

          SHA1

          266cc02c3392af551a1c3f1af10b605c106379aa

          SHA256

          344ee2c2a2f2b9b8c7c6020fa560d9d5ac8106ad49a4bd4b1fda628d33ec2f41

          SHA512

          b9385cdb480dd5fae855ec3752195b70159cf9b56371bd335c5087591505d0d2b4b88810d1cbe7c2b31c57bf4a5eb87c019b3f1c43898ed5227737ef0a5f20eb

        • C:\Users\Admin\AppData\Local\LY8KCin\NDFAPI.DLL

          Filesize

          684KB

          MD5

          38bae3d075bbe75ce96d372f529b7134

          SHA1

          96c046593a006f96cf3d65ea3e7986cbf974858c

          SHA256

          28f3167e7896bca1dc162906a144e6b97e6f1c74dfb7e5e6cd5eaa6e56a8e86c

          SHA512

          efa20be4364505d20e1369db4e214dfa583ecc54f4e248162aa338dc9a1f0f96b65dbe28b70b04705ee030da49c5618b93867d78f337f4d0a3a4e50b95f847de

        • C:\Users\Admin\AppData\Local\LY8KCin\NDFAPI.DLL

          Filesize

          453KB

          MD5

          ef724c7b63693bc92b0333d3ee0a3338

          SHA1

          3f1614a6aeefdc53388b067508fc29940842b1b0

          SHA256

          275332764d06f8ba73a36ea997e67bcede1d9689fa8352ff00135721a6fd2f35

          SHA512

          fe80924b9b5f27e8e4a824e42b64fe57ab91a9adc46bbfa5de7ccf12b3baa2c46583dea043b77c63b8a5979181e0c373a4eb0a6cc8407948ceab1a0af51ea2b9

        • C:\Users\Admin\AppData\Local\LY8KCin\msra.exe

          Filesize

          545KB

          MD5

          7b87c6796a2d7e5de9cd9c8296e03dbf

          SHA1

          5ac568d80e455718d4c0c7e3db03e1e5a456eba1

          SHA256

          a7c7b645fddf4d436c4c068ba9e0bb7a7ccfe7821e636bcdc2a1110788636e1f

          SHA512

          70527ce3ae68a2118ba7b8f21d78a360c54b05ec385a76f3dbef4d218f4af8e4e068621a151234f44a9eb532c1999083c6344de2cdfd0cb493db753f31198d61

        • C:\Users\Admin\AppData\Local\LY8KCin\msra.exe

          Filesize

          538KB

          MD5

          23334362588f6b10e5a58f1ec1b5cedb

          SHA1

          f594c338ce33dbf74c86a2650e6227eb8b6fec23

          SHA256

          57cc160efb221fb3eb4fc57df88432ef933cdfaa3e51e502cb3e4439cdd82405

          SHA512

          72e66119b5ee5b3fd919c39735e03d1ea4f2a2ccaa56194ebb1f93495ba2a3f970861b12b47865fcaac81d2f73d33d3cbd99d6963361496ab4ae872f390cd0b1

        • C:\Users\Admin\AppData\Local\rI0CG6efH\SYSDM.CPL

          Filesize

          53KB

          MD5

          f639c5ee445a2dab4768616969ae4a8b

          SHA1

          e8c48ae686c560dadbd167491089dd099d9d1a86

          SHA256

          8c33f00e874accb229788dbd2a788030e00ffc950562de03f7c04c57414e2a9e

          SHA512

          1241d96d6b61fa3633ffae15d7cd185d673a6dac4b92fe4e1f7844cffcf96e60a1e6669b25cedcffba8a001a1da7ff31a79cfd99d09fe5d3ac2d5ab406a7e648

        • C:\Users\Admin\AppData\Local\rI0CG6efH\SYSDM.CPL

          Filesize

          32KB

          MD5

          3123265084b8049c00dd468f13a5df89

          SHA1

          7e45cbff66ebe4b104eaa500ca8ef60d129a5f97

          SHA256

          24b8b1a6480507869de48b6d5ca2a0f0bcae0f55313c8e0ee05f4198c585f046

          SHA512

          ff95dc8418f18024dcc6ba510f69e57596dbe73d2efff69dca4e88a1af43df2539aa87e289dbab6168612cffe37fa6f1bd627b8db2c95f8e7fe98f9bfd613cca

        • C:\Users\Admin\AppData\Local\rI0CG6efH\SystemPropertiesAdvanced.exe

          Filesize

          82KB

          MD5

          fa040b18d2d2061ab38cf4e52e753854

          SHA1

          b1b37124e9afd6c860189ce4d49cebbb2e4c57bc

          SHA256

          c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c

          SHA512

          511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Gvhynkxuzozqjys.lnk

          Filesize

          1KB

          MD5

          12aa063da2e151cc0d0858f1b71c2c0f

          SHA1

          884c1e2a92a07d7942feca57a26bf17e0c272678

          SHA256

          1a5f39b1dfb5e61052b58420a97f2852247d696ee8adec8e4d47c5df750fa951

          SHA512

          9ca84af97583fc4dfe3c0d950dd51b8e5b16616409deeeec5700a3c432c8333606392fb22deb5b4ce8969dda743c941881325a72d890a4061b011bb8ad71428d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\8wJ0BYT\FVEWIZ.dll

          Filesize

          1.6MB

          MD5

          593297ceda2fc50e55aff253d1d75d95

          SHA1

          124cacd89ceeceb0a4ae608e6d8cdcf0ccdf892d

          SHA256

          464491f646b956e42da47d9fc35623dedcd2cc2f96384bd0a3ce4ff5ed7d1cf3

          SHA512

          ee42dfad2d99a8fb7d10c17f36aaa15a1cbc9fe9fd8856dacf69d92307cbce4976782ada52588686c4f0211500f16122b78ae0a65d35a41ca2d26d5e70c68d9f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CloudStore\jaTILllj\NDFAPI.DLL

          Filesize

          1.6MB

          MD5

          8f2ea99727f33dec0820f20509351ea8

          SHA1

          b7507b1f3c8697c1e8d11838985dd825fca13a6a

          SHA256

          2e44fed26aa40188f50675ea355cf88d354b65c48f9164f62c2fcf6b6055847b

          SHA512

          17b987ededd96d0a7ae1c3679f9a6ab9c563bf2526ba404be82f712f03b5b394a9ddc703e748f9aa03cdda20c0cf6a70db339360fb2e708bbc6c08cddd683ac4

        • C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\nsS3StjpZWj\SYSDM.CPL

          Filesize

          1.6MB

          MD5

          d1adb1ff5f4e49c8e1f763756318e270

          SHA1

          7e53c7a9941168b7971093225da16ea32e91a357

          SHA256

          b0a56fa17035d8e1efc446f85da52f6a8a34f73328e4cc664595e56e7c2cf49b

          SHA512

          e68999aa311a7ba12a9e112497c21f0a928c15158554947f6b3e0f064f98593ddd07f29b19a6b0be7f5d92b3988d4253df14ed943927f01ed02d49b30cc1b52b

        • memory/1496-8-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/1496-0-0x0000011D79750000-0x0000011D79757000-memory.dmp

          Filesize

          28KB

        • memory/1496-1-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/2556-82-0x000001E553C40000-0x000001E553C47000-memory.dmp

          Filesize

          28KB

        • memory/3296-35-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-54-0x0000000002DA0000-0x0000000002DA7000-memory.dmp

          Filesize

          28KB

        • memory/3296-15-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-20-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-21-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-22-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-23-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-24-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-25-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-26-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-27-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-28-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-29-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-30-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-31-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-32-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-33-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-34-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-18-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-36-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-37-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-43-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-44-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-46-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-49-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-50-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-52-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-19-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-53-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-51-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-48-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-47-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-45-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-42-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-41-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-40-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-39-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-38-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-17-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-16-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-61-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-62-0x00007FFD7F780000-0x00007FFD7F790000-memory.dmp

          Filesize

          64KB

        • memory/3296-71-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-73-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-5-0x00007FFD7D9AA000-0x00007FFD7D9AB000-memory.dmp

          Filesize

          4KB

        • memory/3296-14-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-13-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-12-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-11-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-4-0x00000000038F0000-0x00000000038F1000-memory.dmp

          Filesize

          4KB

        • memory/3296-10-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-9-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3296-7-0x0000000140000000-0x0000000140196000-memory.dmp

          Filesize

          1.6MB

        • memory/3992-116-0x0000019208F20000-0x0000019208F27000-memory.dmp

          Filesize

          28KB

        • memory/4856-99-0x000001F05CA20000-0x000001F05CA27000-memory.dmp

          Filesize

          28KB