Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-01-2024 06:25

General

  • Target

    7c6145fc88e55d7bac1db14f71a9f30c.dll

  • Size

    1.6MB

  • MD5

    7c6145fc88e55d7bac1db14f71a9f30c

  • SHA1

    b799ed57dd7fcd9ab9cfe839a89f4cf802460e05

  • SHA256

    0d2b503372e4dc3d29a19e708d6309e96fc04a5845900e890b883a4af1e22bb2

  • SHA512

    02fcd9932d8464e0c88e5aaf4bca5658ff89cd1aa26c80f4ae30b410fc22d03beb63994591d7b7e2d88ead258a17d30d11007c01cf3d35dd9c755455a498aa17

  • SSDEEP

    12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c6145fc88e55d7bac1db14f71a9f30c.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2480
  • C:\Windows\system32\irftp.exe
    C:\Windows\system32\irftp.exe
    1⤵
      PID:2832
    • C:\Users\Admin\AppData\Local\spbVX\irftp.exe
      C:\Users\Admin\AppData\Local\spbVX\irftp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2592
    • C:\Windows\system32\mstsc.exe
      C:\Windows\system32\mstsc.exe
      1⤵
        PID:1688
      • C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe
        C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2968
      • C:\Windows\system32\SoundRecorder.exe
        C:\Windows\system32\SoundRecorder.exe
        1⤵
          PID:1152
        • C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe
          C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:524

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\6ueMzQ4\Secur32.dll

          Filesize

          1.6MB

          MD5

          f4eaebde9ae07a34ff4740cf770cbd2d

          SHA1

          9253135d739d105fe6f943668b8c8efcd24b2e4d

          SHA256

          0b82c5c6b4e642c9f1c59f148cf60d148082f71e75c81a1fbef02e6321f42e8f

          SHA512

          26a33aa9616eccb336ba7de1d32622af9a30c64a1f6770851bcd18c0ef77695a529ddb8973fde33c39d81c8219ba96ca57d3e5b8606d93fd88b4e4449b499470

        • C:\Users\Admin\AppData\Local\m14\WINMM.dll

          Filesize

          1.6MB

          MD5

          581595d5454aa244a38ce8eedb247583

          SHA1

          e2f02ad4a30263b5ce0d8a656002165eaf7e2b6a

          SHA256

          8454a51b2b1286fc682fa9918fac5f6faf49a2a54a7bc49a1bad1b9ce7439c16

          SHA512

          9c53d94b39fd6348f092777c164bd5641a4ce6d18ffbfd2fca0105189a6c2bd2b7b380f6e5ba8425c6657f1781003b368b15ded86cfb7e437a036aa8af5967e9

        • C:\Users\Admin\AppData\Local\spbVX\MFC42u.dll

          Filesize

          571KB

          MD5

          2ea89c90fd859c987f234efd38b5ae02

          SHA1

          fe32eb168aeebfde4866051129c8d400ccd34025

          SHA256

          400feafec263bc6f38041ce5003b7adc8274ebcd95ff253fde81883d8f775d8b

          SHA512

          d98531d35d4a1d3736cc65543840b5ab53fa57a35a2e7d8b6477bc84f0a6bb92f72c14778d6b0dd99bafdd5e3dc45f81fc36e4ab6078d1a27331580016a2e131

        • C:\Users\Admin\AppData\Local\spbVX\irftp.exe

          Filesize

          192KB

          MD5

          0cae1fb725c56d260bfd6feba7ae9a75

          SHA1

          102ac676a1de3ec3d56401f8efd518c31c8b0b80

          SHA256

          312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

          SHA512

          db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Efrsxj.lnk

          Filesize

          1KB

          MD5

          04010e0b7931ec21c9b8aa7025231bd8

          SHA1

          8439a38100c36aeec223c203405a02d8e100efeb

          SHA256

          c8a41ba14c502f0ec3dc239f8c036cc87564a9043ec14a074781e8fafbd70795

          SHA512

          6d11cb597c8844a7462fd35cefd37e7ec1d83fabe3eec73559dcb37a1e630ff9512b429219f9dfb6b57a22d31c2b8e2033131ee46630f66be427aab21879ee90

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\8vOqW\MFC42u.dll

          Filesize

          1.6MB

          MD5

          7191d466bac98bd59c983c12d39b72ec

          SHA1

          e6423cc4adb5d806a3f858d41880c7cb54198848

          SHA256

          9f11febcd2703ba53220b60ad6e339cf31ca8fedc85c4b57055d26a37ae86c6c

          SHA512

          508558d3395c7d1a4d3f25dcee6a64935ba104ff1db9f1f7ef5e493db46bcb61877e8d98e60365d7b9479778e992a341dc43b370a5740d5c2b9792265c962e8f

        • \Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe

          Filesize

          1.1MB

          MD5

          50f739538ef014b2e7ec59431749d838

          SHA1

          b439762b8efe8cfb977e7374c11a7e4d8ed05eb3

          SHA256

          85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3

          SHA512

          02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

        • \Users\Admin\AppData\Local\m14\SoundRecorder.exe

          Filesize

          139KB

          MD5

          47f0f526ad4982806c54b845b3289de1

          SHA1

          8420ea488a2e187fe1b7fcfb53040d10d5497236

          SHA256

          e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b

          SHA512

          4c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d

        • \Users\Admin\AppData\Local\spbVX\MFC42u.dll

          Filesize

          383KB

          MD5

          9bee71871bd83a30c802e4bd738e575e

          SHA1

          f118f32a57530508546400437138fe56a42d0046

          SHA256

          d52acb80d3bc194da0be78c388f094d5e34d62bd74662552d14be910b25606c8

          SHA512

          b0048545526dfcb8a304a46c07033839ebf45806437147626bd8f17b922f99cf1733238236542c7d0ad6e7923bc94729c4c5d6b382f27b34d83478ec35fc0cc2

        • memory/524-105-0x0000000140000000-0x0000000140192000-memory.dmp

          Filesize

          1.6MB

        • memory/524-100-0x0000000140000000-0x0000000140192000-memory.dmp

          Filesize

          1.6MB

        • memory/524-99-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/1280-16-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-21-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-26-0x0000000002AC0000-0x0000000002AC7000-memory.dmp

          Filesize

          28KB

        • memory/1280-25-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-24-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-23-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-22-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-34-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-35-0x0000000076F81000-0x0000000076F82000-memory.dmp

          Filesize

          4KB

        • memory/1280-17-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-18-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-36-0x00000000770E0000-0x00000000770E2000-memory.dmp

          Filesize

          8KB

        • memory/1280-4-0x0000000076D76000-0x0000000076D77000-memory.dmp

          Filesize

          4KB

        • memory/1280-10-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-11-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-7-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-45-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-49-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-54-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-27-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-20-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-19-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-121-0x0000000076D76000-0x0000000076D77000-memory.dmp

          Filesize

          4KB

        • memory/1280-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

          Filesize

          4KB

        • memory/1280-9-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-15-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-12-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-13-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/1280-14-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/2480-8-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/2480-1-0x0000000140000000-0x0000000140190000-memory.dmp

          Filesize

          1.6MB

        • memory/2480-0-0x00000000000A0000-0x00000000000A7000-memory.dmp

          Filesize

          28KB

        • memory/2592-69-0x0000000140000000-0x0000000140197000-memory.dmp

          Filesize

          1.6MB

        • memory/2592-63-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2592-64-0x0000000140000000-0x0000000140197000-memory.dmp

          Filesize

          1.6MB

        • memory/2968-85-0x0000000140000000-0x0000000140191000-memory.dmp

          Filesize

          1.6MB

        • memory/2968-82-0x0000000140000000-0x0000000140191000-memory.dmp

          Filesize

          1.6MB

        • memory/2968-81-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB