Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2024 03:36

General

  • Target

    7c0b7776d8e7e775fb646f2bf3c91c46.dll

  • Size

    1.8MB

  • MD5

    7c0b7776d8e7e775fb646f2bf3c91c46

  • SHA1

    716d6d1caf34896aa69120fc3f08e7f480e3176e

  • SHA256

    6e2ba94de342be1b5ed71468cb2628106a823c38419cbb3fc6f612465523853b

  • SHA512

    874c1bf7a350dd8a81d00b9edfa95efd5c1f58b3b185fe99f8e58e4f3929b7646509c75b5524c49b7c6a679ea4be003471de69f236ea24c18dd192fa5fa50f5b

  • SSDEEP

    12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c0b7776d8e7e775fb646f2bf3c91c46.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:5028
  • C:\Windows\system32\tabcal.exe
    C:\Windows\system32\tabcal.exe
    1⤵
      PID:4624
    • C:\Users\Admin\AppData\Local\KgDgCLleX\tabcal.exe
      C:\Users\Admin\AppData\Local\KgDgCLleX\tabcal.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4636
    • C:\Windows\system32\BdeUISrv.exe
      C:\Windows\system32\BdeUISrv.exe
      1⤵
        PID:4400
      • C:\Users\Admin\AppData\Local\ps3g\BdeUISrv.exe
        C:\Users\Admin\AppData\Local\ps3g\BdeUISrv.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4896
      • C:\Windows\system32\AtBroker.exe
        C:\Windows\system32\AtBroker.exe
        1⤵
          PID:2952
        • C:\Users\Admin\AppData\Local\43C\AtBroker.exe
          C:\Users\Admin\AppData\Local\43C\AtBroker.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:960

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\43C\AtBroker.exe

          Filesize

          90KB

          MD5

          30076e434a015bdf4c136e09351882cc

          SHA1

          584c958a35e23083a0861421357405afd26d9a0c

          SHA256

          ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd

          SHA512

          675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024

        • C:\Users\Admin\AppData\Local\43C\UxTheme.dll

          Filesize

          1.8MB

          MD5

          e1869764e0d2e79ca1973f305fb88cfa

          SHA1

          553ca6ac4c5e43d069b7b82cecd45b07cf981063

          SHA256

          6098597b8235df47ef83d204c96f3056310691690796fb2fb187837db67d6f39

          SHA512

          a35f1fa6ad9dd9c2466f40adb8f428b7b436c08216f3d0b62a53fd4c465192fc34594e726d6d53a410fa67511bf56600bbc6b1fc51d47d4a9dbd265db6d829dd

        • C:\Users\Admin\AppData\Local\KgDgCLleX\HID.DLL

          Filesize

          1.8MB

          MD5

          d3612bc6eee20a2ff7cda0181c1a58b5

          SHA1

          ddac83dabd84c2703264d37bb06e5b12fb16eb02

          SHA256

          9eccf2ac1cac8c0627a5a49f32327646540d11bd9665521b79264985adeea6b9

          SHA512

          d4211df62162c1910abd224d161c1c0036542af07fab092c70faa3ed1747062712eafc22dd002af0ce205db9828facee8288c50ec5a5b203d8eb990e0e1f6e76

        • C:\Users\Admin\AppData\Local\KgDgCLleX\tabcal.exe

          Filesize

          84KB

          MD5

          40f4014416ff0cbf92a9509f67a69754

          SHA1

          1798ff7324724a32c810e2075b11c09b41e4fede

          SHA256

          f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c

          SHA512

          646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259

        • C:\Users\Admin\AppData\Local\ps3g\BdeUISrv.exe

          Filesize

          54KB

          MD5

          8595075667ff2c9a9f9e2eebc62d8f53

          SHA1

          c48b54e571f05d4e21d015bb3926c2129f19191a

          SHA256

          20b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db

          SHA512

          080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88

        • C:\Users\Admin\AppData\Local\ps3g\WTSAPI32.dll

          Filesize

          1.8MB

          MD5

          b02cdb5b656541cb78958d358d40dc6f

          SHA1

          084ecd4932aa300c9d711f15ca3e49adc1fabb1f

          SHA256

          ae0e4c90b8c07841001790b6caf1ed3eac1cae74bf0bdf244824c027be780099

          SHA512

          ed2e305d379ca352027e497a6e2ea9faffcb0fac48f7961de763e5051d6cc70b7112b86c44d9cc4c84cd5a8aea40bf28095493ca5e5a7577e8c45e7d579c1800

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          f21166e7f65374f6120da87470359c0b

          SHA1

          9a669feda974eb2c1c5d685d6aadd7319ede2e49

          SHA256

          63fe54526deaf8292d3d23ebcf47a672f1d5b2305bc317428533e10a58e9a0b4

          SHA512

          988074f9e7b5d44df3c347580bb32434b2a4d13d07454b29528883973ecf6b950a8d47e7eea40c2a752e6d2b925cf118e8c9b82d718ba0208053f275d45a6b8b

        • memory/960-113-0x000001AC7CA00000-0x000001AC7CA07000-memory.dmp

          Filesize

          28KB

        • memory/3408-36-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-41-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-17-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-16-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-21-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-20-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-22-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-23-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-24-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-15-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-11-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-25-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-26-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-27-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-28-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-29-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-30-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-31-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-32-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-33-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-34-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-35-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-4-0x0000000001260000-0x0000000001261000-memory.dmp

          Filesize

          4KB

        • memory/3408-37-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-38-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-39-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-40-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-19-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-42-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-43-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-44-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-45-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-46-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-47-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-49-0x0000000001240000-0x0000000001247000-memory.dmp

          Filesize

          28KB

        • memory/3408-48-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-56-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-57-0x00007FFD97820000-0x00007FFD97830000-memory.dmp

          Filesize

          64KB

        • memory/3408-66-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-68-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-14-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-13-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-6-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-8-0x00007FFD96C5A000-0x00007FFD96C5B000-memory.dmp

          Filesize

          4KB

        • memory/3408-7-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-12-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-10-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/3408-9-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/4636-83-0x0000000140000000-0x00000001401CA000-memory.dmp

          Filesize

          1.8MB

        • memory/4636-78-0x0000020F3DEA0000-0x0000020F3DEA7000-memory.dmp

          Filesize

          28KB

        • memory/4636-77-0x0000000140000000-0x00000001401CA000-memory.dmp

          Filesize

          1.8MB

        • memory/4896-96-0x0000012A3D710000-0x0000012A3D717000-memory.dmp

          Filesize

          28KB

        • memory/5028-1-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB

        • memory/5028-0-0x0000021ED6110000-0x0000021ED6117000-memory.dmp

          Filesize

          28KB

        • memory/5028-18-0x0000000140000000-0x00000001401C9000-memory.dmp

          Filesize

          1.8MB