Malware Analysis Report

2024-11-13 16:41

Sample ID 240128-jkqjpagbal
Target 7c8beaa0420a5e1596bd7da96586b811
SHA256 0f35ac401b512fd1dfd8434325a834942af1b28bd25d7b39dc76e457569cb08d
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0f35ac401b512fd1dfd8434325a834942af1b28bd25d7b39dc76e457569cb08d

Threat Level: Known bad

The file 7c8beaa0420a5e1596bd7da96586b811 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-28 07:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-28 07:43

Reported

2024-01-28 07:46

Platform

win7-20231129-en

Max time kernel

150s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c8beaa0420a5e1596bd7da96586b811.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Groztcac = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ej9EYyKTGU\\perfmon.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1380 wrote to memory of 2964 N/A N/A C:\Windows\system32\StikyNot.exe
PID 1380 wrote to memory of 2964 N/A N/A C:\Windows\system32\StikyNot.exe
PID 1380 wrote to memory of 2964 N/A N/A C:\Windows\system32\StikyNot.exe
PID 1380 wrote to memory of 1104 N/A N/A C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe
PID 1380 wrote to memory of 1104 N/A N/A C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe
PID 1380 wrote to memory of 1104 N/A N/A C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe
PID 1380 wrote to memory of 1608 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 1608 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 1608 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 1980 N/A N/A C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe
PID 1380 wrote to memory of 1980 N/A N/A C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe
PID 1380 wrote to memory of 1980 N/A N/A C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe
PID 1380 wrote to memory of 2456 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 2456 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 2456 N/A N/A C:\Windows\system32\perfmon.exe
PID 1380 wrote to memory of 1856 N/A N/A C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe
PID 1380 wrote to memory of 1856 N/A N/A C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe
PID 1380 wrote to memory of 1856 N/A N/A C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c8beaa0420a5e1596bd7da96586b811.dll,#1

C:\Windows\system32\StikyNot.exe

C:\Windows\system32\StikyNot.exe

C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe

C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe

C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe

C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe

C:\Windows\system32\perfmon.exe

C:\Windows\system32\perfmon.exe

C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe

C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe

C:\Windows\system32\perfmon.exe

C:\Windows\system32\perfmon.exe

Network

N/A

Files

memory/3028-1-0x0000000000230000-0x0000000000237000-memory.dmp

memory/3028-0-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-4-0x00000000773E6000-0x00000000773E7000-memory.dmp

memory/1380-5-0x0000000002490000-0x0000000002491000-memory.dmp

memory/1380-9-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-13-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-20-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-25-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-29-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-34-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-38-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-44-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-45-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-48-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-52-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-54-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-56-0x0000000002470000-0x0000000002477000-memory.dmp

memory/1380-55-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-53-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-63-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-67-0x0000000077750000-0x0000000077752000-memory.dmp

memory/1380-66-0x00000000775F1000-0x00000000775F2000-memory.dmp

memory/1380-51-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-50-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-49-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-47-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-46-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-74-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-43-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-42-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-41-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Users\Admin\AppData\Local\95PM4dzT\slc.dll

MD5 487e0f40f9665bcdef57b7b267f0814a
SHA1 0d4157a16a223eb1130324748d29d31f569e9a7a
SHA256 22d5144d33a0d1bfc5cd8de08c6c54533ec0fdeb489ef2772c7089a421c847fc
SHA512 ea0ff9795960e43a4bccd0ede351e6f2b1f68954f87912881f1928b538cc79759bb24e46b1cb2467f83ea874d693f586a790873def3771862af4a3e6cfeb6eb5

memory/1104-92-0x0000000000110000-0x0000000000117000-memory.dmp

C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe

MD5 63dc867eaf0b0ef8c49fc781c205bbc7
SHA1 fac7d73191e53ffd200243bbd51f84b58ef1dd9f
SHA256 10dabaa8ad1741d72e97766672a22cd704fe197ce123f3ee7c510d3a85891b36
SHA512 2858160e0e5661d122f13e7f9c195cb4f22ddc4761a5a695bb96eab9b471e61f448c6b7591c4a80c227957179daf9555afd54f2cc07e2a66151f89f61d22e320

\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe

MD5 522b113898a30aadc107c9a37e5b3ef0
SHA1 fa7d5f78dfebd992001f714a8a4a2d548749b9c4
SHA256 22ae5d362a8e118a7213edaa1166410c0a65bd90a75c5a5c59615edd86af38fb
SHA512 47c46f03f950c304a36886503f68dc92c508cda5be1d7bb667a24d7cf8cab81f61740ae8a1e70633923a5f928511f94c8732a87d39d340aec53a09b40063128e

\Users\Admin\AppData\Local\95PM4dzT\slc.dll

MD5 314ad450645ef3de198374454c49ef74
SHA1 f059b014912ebb976d2acad4852d49269e36eade
SHA256 a076523b152d90c55ad077a1307f1e8f9b09cf698b876394f6efd46de233fd94
SHA512 9abde651aa4a03cc36f88e555a656abd07925c5a83b6d2cdd5ee00657f0687522357d82c9d00398326b2652053a03e2bf3fefb1ccd39ef4c7879cbb882cb0e6a

memory/1380-40-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Users\Admin\AppData\Local\95PM4dzT\StikyNot.exe

MD5 0d6e241faa0e94ff5946cead6d4acd47
SHA1 39efe8274c2e67a30c67966d8ef86e664eac7796
SHA256 1390a3102208e1525dcb61191f448b65c4d9ea619b03706d4f4b924d8e402266
SHA512 13b84bbdc4cd8cbe448f5631094a659722dfbbbb3a4fe74bf5a5960a6ce85af744e17ba6ce693668cdde9de614a389082073027643e0580adf8fcbc604d7bd38

memory/1380-39-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-37-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-36-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-35-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-33-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-32-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-31-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-30-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-28-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-27-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-26-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-24-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-23-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-22-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-21-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-19-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-18-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-17-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-16-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-15-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-14-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-12-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-11-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-10-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1380-8-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3028-7-0x0000000140000000-0x000000014021D000-memory.dmp

\Users\Admin\AppData\Local\Zt4HpEcKD\credui.dll

MD5 f67ea19ce37e0fbda58dcc86bced08c5
SHA1 20a600bf6ea67418f6bbe7a7464f93925e59771e
SHA256 055dc40a98af18e5d9afd2dd93e852b2d89a8f39f6b84a3c6a2e71d3d04dc239
SHA512 9a32ef22400e6ac172f81d7b6fdbb3797b8b9f1e8e3ee5c83471b12fc1ac4d7570bffb59383b686382ec56aae0972226d3102c86c3764e68fac30a8e9a60ca37

memory/1980-119-0x0000000000180000-0x0000000000187000-memory.dmp

C:\Users\Admin\AppData\Local\Zt4HpEcKD\credui.dll

MD5 cfcd924d256f6d4a72ffeace0ff83280
SHA1 5d10d6a3a28f0d34420d20ffd1940d802fecdb45
SHA256 f44142c3c521e8d717b81a88b8c576567b7e0c5d14f2ae70ff7943c3b1011413
SHA512 818d1ecbfc4a8591c09c9d23d78b86d573c6c3555a2bda4dfa5ad6af68868a62f6fa644fb0bf535032093245aab55b57dc8554f8d4e9edbe11b3e1117c26b92c

C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe

MD5 94e27dd527c12c7cfc0b289ab70459ea
SHA1 5a86418962e010c4438ac90cecfa093ab6825e59
SHA256 23b55d4059f40b37b423ef4f24e5e5d50e82dc6944262832e5fc26bf173d2bfd
SHA512 2ba75649533d54b01720c96879c6406a9b9be91aba0b1a4cb962448bbe97b9c2eb40041d3811a07b5fd39fad21a1c0c82a2bc12b7413f7f198885550e1aa7efc

\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe

MD5 445af7bf9c74bd296eba29b1b00a8fe3
SHA1 12ffc8223f6b2ad089df5d16a8d921576073dccd
SHA256 a4778e3139a4cd550c35e93589bf56f36c60e831d2cb6570dc4fe337955421ec
SHA512 4bead441cd5decb0390678f4f04587930ae455d66ee8b856ec0b843ad611726a509f0e0d53ee0be1df197ed32926b115ae6733a05ab69e4288cd54f65a0d3740

C:\Users\Admin\AppData\Local\Zt4HpEcKD\perfmon.exe

MD5 d77e04e50acbf596ae610b4c784e0c97
SHA1 307d65723a1ef9e22beaae201e1b963ee5cbb724
SHA256 1c905c7ad5a34319e346573fd93455bb38bd9e5c5a1de4fb5c1dab9ed5d9243c
SHA512 e2eef564a3da32db872b5140b8dc24772bb584daec8cb3ecd342b92833afef40d4d5cbe7ad099976c31b388c8b9d9b671a4302c8954cc07b20cabe1e30280e37

C:\Users\Admin\AppData\Local\bHD5Y\credui.dll

MD5 5af4954be1a7c9ce0bd5aa6dcab6afa4
SHA1 68f63842135a503796711958e1f3889b2af94272
SHA256 d6e1bdcde3ceaf8a440c2dbcc0b5d7518cf66c18dc0ba1a66dedfd7622828b90
SHA512 350e8837b012bd0fcbf21bbed90f17dfde14de648bbc213e92e8a831ccfcb8cf132c9bd7a3e23a0e1b21be27ffb3c404b0915b674718cd7dfc55f90a6c487ba9

\Users\Admin\AppData\Local\bHD5Y\credui.dll

MD5 d90a2c5d6e684d7cf06aed24bb9650c8
SHA1 2fbfb5b1ed4255b72864e5364c56396a8e81030d
SHA256 82e68fc1bef22c81f194b6219852e215ea34268a9ac994f7c12d86b336f97ab9
SHA512 bc008a6d343389aa810af71e6095553ff787667c2bbc682be631b7e0324ea74a0ccebb582d52d4a2c67cac277d090dad78275bcaf907f4efe7e4af8f55bea7a1

C:\Users\Admin\AppData\Local\bHD5Y\perfmon.exe

MD5 3eb98cff1c242167df5fdbc6441ce3c5
SHA1 730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA256 6d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512 f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35

\Users\Admin\AppData\Local\bHD5Y\perfmon.exe

MD5 29956abd1568da47bfafcdd46d451051
SHA1 96c90ff0a56727f41a738fff7e13b1dc4fb806f3
SHA256 fadc82fd045e1c3896eb51098ba597592a785f790defd54ec28a6fe30004e858
SHA512 1e31d0cfd3ad66e2b04187a02f3355412eed7c8aabae33880d33b359dd4eedbb3575793223783ff8c363f6082913cd03aa5c3efbeb70af96823f138530516eb1

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CrIVl0TkTGm\perfmon.exe

MD5 69f3986e03dc8f2627e9480445ad441b
SHA1 60e294fd5a834435e114e49b84cbcc9ff9f68aaa
SHA256 c44b9cd6994319172fcb562e51ff5f563b05c3e659f4518aca4eeaf0d1143425
SHA512 54d613de236968f9ad681cf468b6660676ec7baed424abb15712fd72a9568fa72db606d0b15da197892110beae262dc705ff249542abfc27ea8eb23d8ff11b92

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqrvnhd.lnk

MD5 ed5fd88d8eff8cd05e5c57570392773f
SHA1 68401a26c4ced77d3b9918e4a236ea50cc44864b
SHA256 3038cf9ab9fe6727f7bb82b37f0279c0cc04b76be6308c1ba4a1cf8de0c4bec9
SHA512 23fa6fe92b0f117a428cdf54f75ca660fdc16286d224b07e7bf4a66461361f58094f9828079ce2b598d83ed84400f019ee95e05a3c2c0fc3d4945fe79effd732

memory/1380-159-0x00000000773E6000-0x00000000773E7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\KH6H6\slc.dll

MD5 02a6bdbac857ef4aaca518458b162fb7
SHA1 2132a5c825f8c2a92806ef388538a991167693ff
SHA256 ed642a3d9e889215b88712b6c4f90367c308228754bfb71019cb0ed546869ec8
SHA512 02dddb41963f52d923913c69f4d544edb772cab0436768578663f0ced46abba94ed60d46c754b6bf1fd6b967bacb5de9fe9628eb0a0ee4584ccce925e4e2cbfc

C:\Users\Admin\AppData\Roaming\Identities\ej9EYyKTGU\credui.dll

MD5 7d8a47faaa5b6fbf38c9b7bd1cbdb07f
SHA1 12c120e2f115041c53c60994b477507e7ebc559c
SHA256 aa8246949f19fd9963461591183c8ebdbe40dcff7022a89125687aba4fdae79f
SHA512 34c1f6af1ed237e9467e9d893c31bb8c82d90a92bfcf3bbd7349f2a95fa35337232d6b4bc2db04a0db490532103f6aedc1023a8e3116d453c6e1b1d0c4931ab3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CrIVl0TkTGm\credui.dll

MD5 310fb471ad0c6e61a606184787d0953f
SHA1 01f14f72dcbbf57ead7e3ca140da5c4bceb7de83
SHA256 69b97168729a9376fe8abc0c6297ba893ce564ecbb5d5d9a4df946c90159d98a
SHA512 b13211c824d70f930360c75138a5c8197b89242f708919f03514ae172c4a508c2deacdb1f3372450b4882024a18feac86be51f855b7e41dc716eb449c30db90f

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-28 07:43

Reported

2024-01-28 07:46

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c8beaa0420a5e1596bd7da96586b811.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tgnmvdx = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Luh\\LockScreenContentServer.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 2464 N/A N/A C:\Windows\system32\DevicePairingWizard.exe
PID 3468 wrote to memory of 2464 N/A N/A C:\Windows\system32\DevicePairingWizard.exe
PID 3468 wrote to memory of 1232 N/A N/A C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe
PID 3468 wrote to memory of 1232 N/A N/A C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe
PID 3468 wrote to memory of 3812 N/A N/A C:\Windows\system32\LockScreenContentServer.exe
PID 3468 wrote to memory of 3812 N/A N/A C:\Windows\system32\LockScreenContentServer.exe
PID 3468 wrote to memory of 1684 N/A N/A C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe
PID 3468 wrote to memory of 1684 N/A N/A C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe
PID 3468 wrote to memory of 3540 N/A N/A C:\Windows\system32\wscript.exe
PID 3468 wrote to memory of 3540 N/A N/A C:\Windows\system32\wscript.exe
PID 3468 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe
PID 3468 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c8beaa0420a5e1596bd7da96586b811.dll,#1

C:\Windows\system32\DevicePairingWizard.exe

C:\Windows\system32\DevicePairingWizard.exe

C:\Windows\system32\LockScreenContentServer.exe

C:\Windows\system32\LockScreenContentServer.exe

C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe

C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe

C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe

C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe

C:\Windows\system32\wscript.exe

C:\Windows\system32\wscript.exe

C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe

C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1496-0-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1496-2-0x0000021B27540000-0x0000021B27547000-memory.dmp

memory/3468-4-0x0000000002E60000-0x0000000002E61000-memory.dmp

memory/1496-7-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-9-0x00007FFACB0BA000-0x00007FFACB0BB000-memory.dmp

memory/3468-10-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-13-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-17-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-16-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-21-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-22-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-23-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-24-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-20-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-19-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-18-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-14-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-15-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-12-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-11-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-8-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-6-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-27-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-31-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-33-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-34-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-35-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-32-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-36-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-42-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-43-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-44-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-49-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-50-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-53-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-55-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-54-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-57-0x0000000000F40000-0x0000000000F47000-memory.dmp

memory/3468-52-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-51-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-48-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-47-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-46-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-45-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-41-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-40-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-39-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-38-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-37-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-30-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-29-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-28-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-26-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-25-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-64-0x00007FFACBBE0000-0x00007FFACBBF0000-memory.dmp

memory/3468-63-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-73-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3468-75-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Users\Admin\AppData\Local\R5mIsRN\MFC42u.dll

MD5 fe6ec32645ad414945132d3ab9b0dc1b
SHA1 6a8f32053ba59f291b9f87cc698b035ac720220a
SHA256 d57f8f59bcca3d0e363b787e4e4a70dc928871b14610f15bfdf2c6a17e95ebc3
SHA512 43887276af57d1bdabbc9edb72fbd748a1e0d24f3ee163984e7bf59a66d4af4bd741c12cf32cb306659ecd1cec9c6a77e83676849baf10d09b4fd76ff4fb893f

memory/1232-84-0x0000000140000000-0x0000000140224000-memory.dmp

memory/1232-86-0x00000191BB550000-0x00000191BB557000-memory.dmp

memory/1232-92-0x0000000140000000-0x0000000140224000-memory.dmp

C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe

MD5 d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1 b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA256 2adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA512 1191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f

C:\Users\Admin\AppData\Local\R5mIsRN\MFC42u.dll

MD5 4a5a55ac826919bbcd8f7d5040806fac
SHA1 30ebbf016f529deb1eb4a797c0e2cf8bf14c94bd
SHA256 286e41f6750449af377af3fdcea9923ce0d9bb65d971a24a864b10df5e3a9537
SHA512 cbe656f5a568146dd0659f68977e0d0f8d118b3e999b7b555754a5799e7f8fd9296b7ff6f8e6c85ddcada681518bdd06332bc505e0d940cd153a9372ac3517f0

C:\Users\Admin\AppData\Local\R5mIsRN\DevicePairingWizard.exe

MD5 fb9244619da2c455b35d4e9999d27f60
SHA1 725f7bee3db5bf71ec502e05a9f4e7d0193374db
SHA256 172667cd4f99083e0a414fd02bf28b42fbf2962d71e8c70c58c3c83ae3c5a2c4
SHA512 740dfe014af35c1eaade576a9854c982ab08d85f3c2267732bf6b579142f323493bd6824c59bd299af382be62051ddb63115980d8f4369b4315521fd2d5c5a99

memory/1684-104-0x0000000140000000-0x0000000140263000-memory.dmp

memory/1684-111-0x0000000140000000-0x0000000140263000-memory.dmp

C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe

MD5 ef68d21df2bdc31b0c73de35c619388e
SHA1 f0005382d215162b77bca349c49255c7247009db
SHA256 a60316652877737528052e912df759817a148524db7907b9d2f20183320d3a0d
SHA512 846636175a9e0397acc2eba3471665457f66fd57f2f7196209c9856485fcec85afad1f181ca3c423364d6a4190d84bb31791ae74fd5bdce5b7c603df6db9d96c

C:\Users\Admin\AppData\Local\DkPEivbGH\VERSION.dll

MD5 d21bd2498ae1b7addc6eb7fa91dacb87
SHA1 15761a950885b99d97160068fba32647d1e614cb
SHA256 f22352087ad21eaa5a43d45dad393d1849ae41c0dcf02e3a2c1df4e89c01a1e1
SHA512 3c37c470abd80c9ccac9c0cee64e04e041e52a9a1b5cf3c41c89dcc5eeeb2fe409668ff1a3be178cbc6ca2f38690074fa8f926ff4dd11d44e17aa527a5e42b8c

memory/4784-125-0x0000019D65590000-0x0000019D65597000-memory.dmp

memory/4784-130-0x0000000140000000-0x000000014021E000-memory.dmp

C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe

MD5 f4f896e675956554dfbbc3819137c259
SHA1 c42593b63c1d653cec310300a8055b8fbf81408d
SHA256 79a714d60bf7572924d7bdc233300b35eff1a16342a1170d20977af3c7f4c8b6
SHA512 1d3eb2c6b77c767ec92e3c9d0c4ac06d052ac09c2ae137164c379922da9f55224047c8416d55f83ce7aa7b714da6fded2d0054d0ff4705226e2ee89812d1a026

memory/4784-122-0x0000000140000000-0x000000014021E000-memory.dmp

C:\Users\Admin\AppData\Local\DkPEivbGH\VERSION.dll

MD5 3a75bbf7ad38a41a59c6f10e9bc6fe0d
SHA1 5fec5b0fc55f917a84b77a85af9f71bc8c02ba3c
SHA256 e380ae768861c1a96e66e2f164726d733e415636444f84d85304b2e34adf4fd6
SHA512 2416581bfb6567d935d28e675f33c4c4db13fdcb81065c08d2e5b775c21e56f194d51c3d7b3e1b5b4b89dde7f2583e56754c69586adc1df62649dc7e7c272c72

C:\Users\Admin\AppData\Local\DkPEivbGH\wscript.exe

MD5 2d91f316e59a34013a094e832888740b
SHA1 e337935c2d57ed9849083b681f74c784cfdf3f1e
SHA256 ced0f33ce911f5033deceab826b95d6db3650e2ec3c9748a532f767f5fa34327
SHA512 e7adaa5b76007d7586e0fca3830cb6dfc63b0e2320e1321e1ebc7a476e04971eb8300d3c893cc8edfca21d860b629b90aa65456572b1a3f99b2a98a9c98cae9a

memory/1684-105-0x000001852E6B0000-0x000001852E6B7000-memory.dmp

C:\Users\Admin\AppData\Local\VRs7vDeY\DUI70.dll

MD5 0366f1b70ea20b3bad86d58a851b48de
SHA1 90ca3b94f22a41926217d16e80cc0991ca73660d
SHA256 02d286e601812fd9c8dcb01ead012ad6db2208510fc2f5017a413cf3473cd652
SHA512 a23f0987b37ed52d8f73f82a2c89de88ab3feb7472b6b82d061fa2e984191638a2bca70cac97f80d3617df7f9eb1398ae30066d4842ff2ac69e3a408a99dd36d

C:\Users\Admin\AppData\Local\VRs7vDeY\DUI70.dll

MD5 f00cf02cc221297262bfc295e7e948ed
SHA1 d2644f0883da7718bd526ddfed9441c22d8768ea
SHA256 1155096269011bfd14dfc1bffcde7f7c3665c030c8bc243c1e9c6197518fdff9
SHA512 ce220f65adfcd56eaa1670524ea7bd223c5592c5265ba9fc9d38ce710686d14f02110980c5ae2aae53673bcc99d32e0410f0705fc658360d7e5809bebf794b33

C:\Users\Admin\AppData\Local\VRs7vDeY\LockScreenContentServer.exe

MD5 a0b7513c98cf46ca2cea3a567fec137c
SHA1 2307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256 cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA512 3928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqwbkkvq.lnk

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Word\ve72mnJK7Ls\MFC42u.dll

MD5 ac4a2cf852041592d2faa8c71a7995e6
SHA1 e54491e3408884c59ac35db3490c8101d3a12dc3
SHA256 b79aad0daab95462dc691ee7c378da2a4e0095aeb9090a427027271b88b3e06b
SHA512 28c3c54c16e1b7607372a0bb4aa6b340e34e572f006d74b3a6303e033b64819db68aa6ff136c2604d34cdb71d7418104df3c14dfde6733ebd0faaa0ead2d0a07

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Luh\DUI70.dll

MD5 a145a17157aefa571b5ea874950b01d9
SHA1 988c2c9143a0e701e1807429e3e5ae59f6f24cc9
SHA256 6cfb5e55ab2a1e085af3338f4d172445eb658dda4cc9ccc4b32134b07b9ca972
SHA512 56e79f88579856875b24d768962d615f91621bdab372c341fdb5455a5157e6d220bcd9b463053572a784fcd270984e512e1297329387bbdea90c4d56cb2b9827

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NsSRf8w\VERSION.dll

MD5 a3984db5d7e176238d6c0dcacea16463
SHA1 73b22c66d778dbd48e8323a9559efae0a5c6f178
SHA256 13e5012f0fcb557af17f8176bf0a8f0b087bce1c809fc40f84e0fe994e2f663a
SHA512 a1dd6b9a18e3828699d4bae04387d5b7614c8cda092584c65d8fed42c4ec509bdc86f1be6e3d0b63d506bcf1ec50a50f7fb34fdc3116203a6196a860748f7e34