Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-01-2024 04:12

General

  • Target

    7c1e2e5883295d072f73627f00279333.dll

  • Size

    3.2MB

  • MD5

    7c1e2e5883295d072f73627f00279333

  • SHA1

    d0308ecef0df53a4b448d8d59ed4c99efb0bb9c4

  • SHA256

    20d290a43af5edaff7a58b11a463755ee38c570a6e9258e9672146566ed58ced

  • SHA512

    cc59d338eddee33127471a1ce20f6021889b7d2d795111804105c93127c28dcbfcd23d5e04711e011629a932eb5d62fe7a8d7987c9e42963508a5bc353d6538b

  • SSDEEP

    12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1e2e5883295d072f73627f00279333.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2488
  • C:\Windows\system32\irftp.exe
    C:\Windows\system32\irftp.exe
    1⤵
      PID:2892
    • C:\Users\Admin\AppData\Local\Ffhcg2RwK\irftp.exe
      C:\Users\Admin\AppData\Local\Ffhcg2RwK\irftp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2756
    • C:\Windows\system32\UI0Detect.exe
      C:\Windows\system32\UI0Detect.exe
      1⤵
        PID:1768
      • C:\Users\Admin\AppData\Local\6OnPwGdDt\UI0Detect.exe
        C:\Users\Admin\AppData\Local\6OnPwGdDt\UI0Detect.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1584
      • C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
        C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
        1⤵
          PID:1084
        • C:\Users\Admin\AppData\Local\aY8\SystemPropertiesDataExecutionPrevention.exe
          C:\Users\Admin\AppData\Local\aY8\SystemPropertiesDataExecutionPrevention.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2152

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\6OnPwGdDt\UI0Detect.exe

          Filesize

          40KB

          MD5

          3cbdec8d06b9968aba702eba076364a1

          SHA1

          6e0fcaccadbdb5e3293aa3523ec1006d92191c58

          SHA256

          b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b

          SHA512

          a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d

        • C:\Users\Admin\AppData\Local\6OnPwGdDt\WINSTA.dll

          Filesize

          226KB

          MD5

          68752e53704704ce4cb6be677d37a111

          SHA1

          38533b77ff0a07627e3fd5ba5154eea96eb2618a

          SHA256

          a24d5935905c1c1cafc9212a3215890001149e1be9dcd1fb8a229b058f890dc3

          SHA512

          1bd4f0e5f160ba7872e87f4469e7c15189301a960824c2ca2ea8dba9f12ed1db616cb03188841deefe98a84af0e63224e82a7b16154512aa83f54823d4bf2e43

        • C:\Users\Admin\AppData\Local\Ffhcg2RwK\WINMM.dll

          Filesize

          104KB

          MD5

          ff9e1cc81480937a3ccfdd61e8fb072e

          SHA1

          74c83a58c44c62e57b25c9aeea2607650eb74d3a

          SHA256

          72409a4f54ac0f049b119fa92795adba88f66e5cd4658610a7dc588a5a290736

          SHA512

          8898480142795d16f60027039773e6fc974fd8e9f88939493eb998f29567287b1dccd47ba819b33294ce4159cc1dbc5db1805949629f01fb06a3905f6e2498ca

        • C:\Users\Admin\AppData\Local\Ffhcg2RwK\irftp.exe

          Filesize

          192KB

          MD5

          0cae1fb725c56d260bfd6feba7ae9a75

          SHA1

          102ac676a1de3ec3d56401f8efd518c31c8b0b80

          SHA256

          312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

          SHA512

          db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

        • C:\Users\Admin\AppData\Local\Ffhcg2RwK\irftp.exe

          Filesize

          82KB

          MD5

          27fb112b432868929145a202c6454755

          SHA1

          c17b31ed1de523b938325976bb29298dd70f497e

          SHA256

          fdadc65ea3df6b291df31f45c1b892805987831e7e09b68fcd0363454928e839

          SHA512

          1a2763efa72aa8d006776c5b0e4aacd446618e806d18c08bc5de95e6a327b9f745b54055bedae4402fee3aae057899bb224ee17bb60cd123e91ae5621c7c770f

        • C:\Users\Admin\AppData\Local\aY8\SYSDM.CPL

          Filesize

          17KB

          MD5

          34654c5000e25d14c8a41452db1a553e

          SHA1

          ed65fb9d871ce63b75e31388a934876c070896c2

          SHA256

          a38f49f4df8c8e0a8917df787b105ead4a35aa5d0ec45e2ce133815b56220e90

          SHA512

          4fca48e6b7bdc0c3cc986af658c896eea4e642b40715f1580d4e2ad55c402a18f32d8219e3e6863a7da43fbce636c1aa5e806c8653acf28943be458a838f4995

        • C:\Users\Admin\AppData\Local\aY8\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          5KB

          MD5

          1ffb9b9f012a216822509e82a49c4c14

          SHA1

          4fa1cda19d8c9062cbca69c9f767249fd25f42fa

          SHA256

          8c404130d92403cb5325b25b875172d853b8d71e4b030cf616e4e535863e4b66

          SHA512

          02ca1cfff20c18dc6d131fda2832703bbe5523ee1dd2fc098859178af5276a4e75b5baa634ba878818c4b738f8e917c638e1d01b62f44a544e58b0ee54196e7f

        • C:\Users\Admin\AppData\Local\aY8\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          9KB

          MD5

          d4c2b5fe916656bddd76e1bf691ae971

          SHA1

          935eaebb779ec946911093e0aa4463be70685edf

          SHA256

          1ba6bd7ec0739aacc91b968409687e794aabd79133a2e820f5da8b33c634aa20

          SHA512

          c7fc1c2285cf889c9e88d4604ed0023ed78e262853a5a3c4ef35a7b55611f0a65df2d362c7dc62a96f321ab34e4523018e9c084588ce1bf75f11f0babe0acc9b

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tiizeasb.lnk

          Filesize

          1KB

          MD5

          6b1dca5693f3ac7f92a17db60931ade2

          SHA1

          0e6c4cc2169670af5eaf3d736f998ee24b6f38e6

          SHA256

          d070d405953093fbb0bf50271daa424dd4ba22617cda3827578d10799c5ae5c4

          SHA512

          a8877c4e2e208440d82b98b5fb1b456ac5228c01a807af74d4cb0d7a5d0c59e0c0abea9d88395657b5b02fd2d6ae11e36db0fcd5834c20eead1455acfc67b72b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\A4\WINSTA.dll

          Filesize

          39KB

          MD5

          207cc835694fae24ae6fea7e09952d59

          SHA1

          8f940bbf87120d7232c57e5e09e82be6a82f5b11

          SHA256

          4efc72953b0307f9e2993a11432580c32fc6582cc6e15a0f7243b75d0c89c8d2

          SHA512

          80e376423ec2cbf3d258f25e3b19b48bf31ab45338197b8b62bf34b3f0b492b9b7358d1f4e03a52b5219ca943214b85c52dd15f1eb2788c994846d18adbb3dac

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\MAu\WINMM.dll

          Filesize

          96KB

          MD5

          b183edf18ce06e56745b7ebfa899bc6d

          SHA1

          32334b2983308a662b75cd08ab5e2c228e481248

          SHA256

          16dd3d9e834358931a104cb4a37505739b41cb02336bf0c268fc1a0419643389

          SHA512

          fc2c03d29f76d626360817d8b6ab133fa62a1dc0976b42bc142b0063a57f4a8506227f3bd52ecf8bf63fa16544c600c5d91e643c035b9afb95f7e4cbe5f482b5

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\wz\SYSDM.CPL

          Filesize

          95KB

          MD5

          c2b99394bd095dc1265d08a72212b81b

          SHA1

          b235a71bcf2d5e2f21d627060b33636ca40ac421

          SHA256

          93891343d0cda68c20854f7840c416340a867e69e1518dd98a44461fe4df1bf0

          SHA512

          2837897b8766fc5151de177b3db991764e97c37e6a95e078e8d2ed300c46b659eeab83bd9df67e3f0c6c546d770b802379ecb7306f8197072147116fd358954f

        • \Users\Admin\AppData\Local\6OnPwGdDt\WINSTA.dll

          Filesize

          140KB

          MD5

          db9b7a3833105bf60ec88807b8cdded2

          SHA1

          383d6ac1a6134ce560821fe3954797712829f0ae

          SHA256

          4454e2dd955165912a3543ddc8480046229c412bbf1669198fb8df11a51bd97d

          SHA512

          2c998948a477d8726d4c9a74f959e1c1c9f7e3c11e5c75c57de50913cd78a6af59a131566c20614736f95a3ccfbcf235b21fbee3638c276c4db245dc9e37b80f

        • \Users\Admin\AppData\Local\Ffhcg2RwK\WINMM.dll

          Filesize

          150KB

          MD5

          2acaeb2b67afc582b4279ccc27b849da

          SHA1

          c0bda7cacf86b7ef2b6532230d32505dfe1c7189

          SHA256

          f623770873077f03464469bc2ce5e19618f895e43f47f3f18b97efe47bb5699b

          SHA512

          72a7970ba953691f106faaf5ce44c6962c7433beb29c8dcb94456b88da5f659b5c33ed16b092f47df321410499ef5e91b39d5741111547660ff0f7314c9eb954

        • \Users\Admin\AppData\Local\Ffhcg2RwK\irftp.exe

          Filesize

          99KB

          MD5

          eed01552ad4c50a00ab99a6f4c3619b2

          SHA1

          7de99f2e499ac1f0548eec510a38ecc2d8f75242

          SHA256

          891138dc953c701c432aa98bd32b926785a6fe4aa0980fd2364e66938008f630

          SHA512

          fccbd6fa434e237faf7abcec1600ec6b02dd9cadcb31bec6c9793b4a8aa91e1f1ff9190aa30a1a75f02003c64c5898fc86dceb3b67e7b9052f98a02a46a5fb0b

        • \Users\Admin\AppData\Local\aY8\SYSDM.CPL

          Filesize

          37KB

          MD5

          e119cce8ae2101e65574939c90b400f7

          SHA1

          97d78fad300f914f2f2eb30ed46df56785a9ae15

          SHA256

          343aeb53f1a67d767e8f6e4aef650bf1313eff22f87c8caa255bf5860a0a14e2

          SHA512

          56f3a0df37764bf19b36d552a54763e1d0953956684164b57a1de82f644c3900d5c66ca17da9aa3a85958b79737baf27c3a8b885deb2a339300f86f08faa2c56

        • \Users\Admin\AppData\Local\aY8\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          53KB

          MD5

          5ff88343abd37e15a5c072d4aae85730

          SHA1

          82bd3c054fedb317bab5b7ce9b940f1c176d36bc

          SHA256

          d6909dbe019ac80ee65fc6eaed9dce84d7ad89a4383924e4393947bc90067cb9

          SHA512

          40792986d93124322c42e84f2e4e2b326c939e8b55a96e22a6b955b3e9f200e4012d6a2ccf09a68309d708938b1435e7a2261b061cb2d92c1563e3493334ef9b

        • \Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\wz\SystemPropertiesDataExecutionPrevention.exe

          Filesize

          57KB

          MD5

          78f14b763b3697606cfc5fe4a646badb

          SHA1

          89716f9885570e252ce9bd84a986a14ef822d82c

          SHA256

          89d1cbcc525009e189e16c85d64569ca6749cf909ecdda485cb569db360095c7

          SHA512

          4f6c019fc32b4ab9a474c2df99847505bdca1221bd758a1e9a461145c1ec8132d03157e730f6f8d45d7ed4c3310dd66ea4624dc65db0096cf9f8d1163d22314f

        • memory/1184-63-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-31-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-64-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-65-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-4-0x00000000776B6000-0x00000000776B7000-memory.dmp

          Filesize

          4KB

        • memory/1184-72-0x0000000002470000-0x0000000002477000-memory.dmp

          Filesize

          28KB

        • memory/1184-61-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-60-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-58-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-57-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-80-0x0000000077920000-0x0000000077922000-memory.dmp

          Filesize

          8KB

        • memory/1184-79-0x00000000777C1000-0x00000000777C2000-memory.dmp

          Filesize

          4KB

        • memory/1184-55-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-54-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-52-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-50-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-49-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-47-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-46-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-45-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-44-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-42-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-40-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-59-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-56-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-53-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-51-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-38-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-5-0x0000000002490000-0x0000000002491000-memory.dmp

          Filesize

          4KB

        • memory/1184-37-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-36-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-35-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-34-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-32-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-48-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-62-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-30-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-29-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-28-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-26-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-25-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-24-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-22-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-21-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-20-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-18-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-17-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-14-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-15-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-12-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-11-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-10-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-9-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-7-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-43-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-41-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-170-0x00000000776B6000-0x00000000776B7000-memory.dmp

          Filesize

          4KB

        • memory/1184-39-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-33-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-13-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-27-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-23-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-19-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1184-16-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/1584-127-0x00000000000A0000-0x00000000000A7000-memory.dmp

          Filesize

          28KB

        • memory/2152-145-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2488-8-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/2488-0-0x0000000140000000-0x0000000140338000-memory.dmp

          Filesize

          3.2MB

        • memory/2488-1-0x0000000000230000-0x0000000000237000-memory.dmp

          Filesize

          28KB

        • memory/2756-103-0x0000000001AD0000-0x0000000001AD7000-memory.dmp

          Filesize

          28KB