Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2024 09:15

General

  • Target

    820d38a0c687ab0b550fe547c7bb1d6a.dll

  • Size

    1.7MB

  • MD5

    820d38a0c687ab0b550fe547c7bb1d6a

  • SHA1

    cf838d2bfcdc092fc2ed5d91225c487dbeaa0c54

  • SHA256

    9ddd12552dc5850ed10c847816d6e5f80272a66117d765587662065ede3435c5

  • SHA512

    a0786486bf985c7872c50c7e6a5af21ecee4295ec3fff1cae965d59422004bc00ce346e31c66a2af0c0481db634aeb87393dff80795f6a57903ee3f17426ca4e

  • SSDEEP

    12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\820d38a0c687ab0b550fe547c7bb1d6a.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2088
  • C:\Users\Admin\AppData\Local\rmMTk\msdtc.exe
    C:\Users\Admin\AppData\Local\rmMTk\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:2076
  • C:\Windows\system32\msdtc.exe
    C:\Windows\system32\msdtc.exe
    1⤵
      PID:1412
    • C:\Windows\system32\xpsrchvw.exe
      C:\Windows\system32\xpsrchvw.exe
      1⤵
        PID:2960
      • C:\Users\Admin\AppData\Local\bDxi\xpsrchvw.exe
        C:\Users\Admin\AppData\Local\bDxi\xpsrchvw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1632
      • C:\Windows\system32\dvdupgrd.exe
        C:\Windows\system32\dvdupgrd.exe
        1⤵
          PID:2188
        • C:\Users\Admin\AppData\Local\HeBC\dvdupgrd.exe
          C:\Users\Admin\AppData\Local\HeBC\dvdupgrd.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1732

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\HeBC\VERSION.dll

          Filesize

          45KB

          MD5

          58cbfac6abadc2d92aff1c5c5aa86879

          SHA1

          c160e19ac173df690ec73da52922ea6abd395833

          SHA256

          f0db1da855ef94cb20981108b374d4320d84461c62caf2071dd0a4562f7fad41

          SHA512

          32d05690c639377cab09b7edc1f1ee365257f6efffc8b18cfc7576bd69ebb9302ec57a45e358eaa2daffd04774f85664bbba0cfed23446428ba971ffcf192373

        • C:\Users\Admin\AppData\Local\bDxi\WINMM.dll

          Filesize

          70KB

          MD5

          6444714a86acf918262446a41b131b98

          SHA1

          3945fc27b26fc68dbadeaaf8a4d59dd7135329df

          SHA256

          26c0b88b4fc45448fa9d4b96524aeea0dd81c6f95024a3a204bae605dc851d80

          SHA512

          3351fd7637243929beb4be3acf4a75656624426d0061e9271dc3bccaad098d1a851f69c450d49a9eeeae140676d509b647574fe957056e21d0da5c4d48972bc4

        • C:\Users\Admin\AppData\Local\bDxi\xpsrchvw.exe

          Filesize

          76KB

          MD5

          3e2646f3d1a868e0774bdd6bf0e3fdbb

          SHA1

          a4ad399a09cbec61d66bd54fddef7c746d06b331

          SHA256

          b93ce0e56607aca153204c2f5818bccef6b06281de99af7edbc11b15afbd5b21

          SHA512

          ae262b118eaeb06798d45f1f609ddf4f5c678f441cd48f71e3bb4b457a03c41fdd0ca5813d7a75a4ed1a70bd6bec97edd8c47f64fe5e372be2116ef71dc79536

        • C:\Users\Admin\AppData\Local\bDxi\xpsrchvw.exe

          Filesize

          70KB

          MD5

          8a338de9707bf3074d52792f3a4f63f7

          SHA1

          c881b28391d8356aec51e921bdddfb6e9d0ce10d

          SHA256

          9d510d9cb87dd7715e6c7d23ae6263d42acbbe1cc8ac0af73c2c094ed41bb5e2

          SHA512

          57c91bacc0190f48efe616804318e0689b5e14980c9d206197aa2758294e669e729074a8b5d6594a723674948a4e87981280f9c5a681a610eb50a2a87d615421

        • C:\Users\Admin\AppData\Local\rmMTk\VERSION.dll

          Filesize

          50KB

          MD5

          52f8a5a54b41ca32c40a6916e73197ce

          SHA1

          01ef11397d73f279faf22addedc73eadb900d45f

          SHA256

          bc567c5f7a0fdc576b562168def556bd7edaa09c2cd64cbc4d923cfa9dc7f944

          SHA512

          aa54d1e7f4727ae0420821baa9c83cc12a21582072b44acb460eb71f479cda3329a167685fcc8584785a3d44264ec007c547545283ef62cdee83691f7ea98786

        • C:\Users\Admin\AppData\Local\rmMTk\msdtc.exe

          Filesize

          27KB

          MD5

          8d0d0b42476449211e2ea9c4aed1b16f

          SHA1

          de9b4f5cf5bf5a975da5f343791a264e152c4e2d

          SHA256

          9d70f548379eaf1916fbfb5b3c04a05419885a8c0078027ff196e7fd921a9c83

          SHA512

          877b59c824e648a990700c2f0449feaacaf25d2c3284fcca2b3ebad0d5607c04a2d80195a637a6750a92ed1c3ec0399e2573c56ec1c11a6de3a67fd8ab256eb0

        • C:\Users\Admin\AppData\Local\rmMTk\msdtc.exe

          Filesize

          6KB

          MD5

          04f9770f8c428db3a7c5fd5024e2e773

          SHA1

          779a87a6359532e8efcb4d73937a665e953f2237

          SHA256

          81a24f85a8e976c180ebc8a17d332a0d3f96a315e649dedf0e5651fad85f5d5d

          SHA512

          c0d8ae404c5fc85890c68b5e53b1c530626a03cc4c7a63e35b22d5b8b99d282345d530ba2709b45cb0b0a52087f94c38afe4d3aab86b9c4182439178cbee2f12

        • C:\Users\Admin\AppData\Roaming\Identities\{EE07B9B8-79CB-4B35-87AB-D4E1BF99C984}\N25vjPXg\WINMM.dll

          Filesize

          1.7MB

          MD5

          c6a8780b9094a4c9e576f25e0f203808

          SHA1

          726b0512a2118a0c08e68cc1e6f5eeffb1cf0008

          SHA256

          4ab0fa46684644ea21357747ea3d115d76e0e38808fb4ecc52da49a9058338ec

          SHA512

          1f0dbc64709a895a36303cda98e3fdaa617d0bdde582cf797993aa62ce2be16e53ec1c14f0fe1ff667dbcccbf4f2a4bbd070ab407bcc6bd09bd44015c2f84c24

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Gmfoo.lnk

          Filesize

          1KB

          MD5

          444afa9370f304f2a7246432a51b8188

          SHA1

          15964e83c411589d86c480cb86b34bad1765bd57

          SHA256

          d6c054ca01e14f68363dca9d7dd448211d1b4bd92ace134fd9f12d3d4579046d

          SHA512

          e19cc76999cca62a6be62fb207ef8fdf62327cb5df468844b66fa33c7e24399979b04550b4ca7c3fd56523fe8c90752f8bde0fffa38edd107a538e63286dbe6a

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\vR\VERSION.dll

          Filesize

          1.7MB

          MD5

          62c6aa0a49457b866379408ba07e52a2

          SHA1

          06a5034b12012e61359a8b8afee1ef21daa26067

          SHA256

          3d68c0a1a91c9fa7dcd896d239922995d78d8c23d79ce249557d769ced376bd1

          SHA512

          20a6948f44d5c10bbbc012b3d162173443496ad98757561474df4fae95be1dc730f30e1f1963a17dde14bbb49ea3584bb1e8708493951d44a82da96ef127c8f9

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low\BtuQfAZZER\VERSION.dll

          Filesize

          1.7MB

          MD5

          30ee7c135b5e11f6d07a50f7fad01ee1

          SHA1

          3913fd92a91185fbe731a3b8bea5eb68edf91cb2

          SHA256

          67956266b4948bf6e3cf27746b5522a6f22a809c5c660004798212c2ce2ba843

          SHA512

          7bf8d139fb7a685b08c667cacf4d1a599f597c08b657fa027a530a865a9e0cfda3af1e84bc3ff38e0c17184145425cbf2311a0af7e2f6970e956cfd7cde8d7ca

        • \Users\Admin\AppData\Local\HeBC\VERSION.dll

          Filesize

          76KB

          MD5

          fdc0988d1be75ecf8ca94637eafb9d17

          SHA1

          259e4c5b15ebbf6c2bd1c32e67659e71d1e02950

          SHA256

          ab7d21de90a43de9723ad062e26326690ce8b72d5768e6583318dc6ec384a5ff

          SHA512

          b6c1c69eb81968fcb4cc4948b6580d753d88be552875d82a6f3d1159997210a68ac3e9f541e6b43165135e0eaf8ad7c332d3ba886908efc7014babfbe101a7de

        • \Users\Admin\AppData\Local\HeBC\dvdupgrd.exe

          Filesize

          25KB

          MD5

          75a9b4172eac01d9648c6d2133af952f

          SHA1

          63c7e1af762d2b584e9cc841e8b0100f2a482b81

          SHA256

          18f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736

          SHA512

          5a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769

        • \Users\Admin\AppData\Local\bDxi\WINMM.dll

          Filesize

          45KB

          MD5

          ea3d8c37c78f2a613539f3dcceb68282

          SHA1

          1a44a18cb4fec329cfb4dcf0074712c693e583da

          SHA256

          428a724f11082b06ee0e0377cf512dada65e1405966a7b4f7cabe1a702377c05

          SHA512

          9c3fa5aa16b271b29616d49025f3313a46064e0dd1582d9ee3c1d8b61d10468f83264f85940a10cd6b6a80ba1c520f6109a49729e16e3b79a195f8d7f3c814b2

        • \Users\Admin\AppData\Local\bDxi\xpsrchvw.exe

          Filesize

          45KB

          MD5

          84c667411eb48a55d85110ccfa8b66e3

          SHA1

          eab28a3548c6b8d9363d2ab0229331cb75d93b33

          SHA256

          c45c4a1ccaa0f70bc30fa7d5f95a8ea5c22520b0bfad6a365b8913d805a61279

          SHA512

          fa490be19eb18dc52913623a86eaa547fb46dcde6f6b2e773a8af94cf0852c80f380e8e55f2d726849f001d3dd15ff405ef07d056ed5616777696dda7e3536c1

        • \Users\Admin\AppData\Local\rmMTk\VERSION.dll

          Filesize

          1KB

          MD5

          e8a4711c70110f534df903f74c385d43

          SHA1

          a2a38c864830d40e48a6c133174e362bf7a3800d

          SHA256

          2a94850ec9f9e20a70de062a634a75196899aad6c2c5da660f19b36462f43c91

          SHA512

          21954e66782bc2e66be77dc194a5bbeaabd36c28ad5997b2ceb3823fdb5d3dc299f14c5292cfa7143a75c6aafa86f4b99412062b5a63de15168839d83ef8a3cd

        • \Users\Admin\AppData\Local\rmMTk\msdtc.exe

          Filesize

          138KB

          MD5

          de0ece52236cfa3ed2dbfc03f28253a8

          SHA1

          84bbd2495c1809fcd19b535d41114e4fb101466c

          SHA256

          2fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3

          SHA512

          69386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3

        • \Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\vR\dvdupgrd.exe

          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • memory/1252-18-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-41-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-32-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-33-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-31-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-29-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-51-0x0000000077361000-0x0000000077362000-memory.dmp

          Filesize

          4KB

        • memory/1252-50-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-52-0x00000000774C0000-0x00000000774C2000-memory.dmp

          Filesize

          8KB

        • memory/1252-28-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-27-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-26-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-24-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-25-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-22-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-61-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-23-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-19-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-4-0x0000000077256000-0x0000000077257000-memory.dmp

          Filesize

          4KB

        • memory/1252-65-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-16-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-15-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-13-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-20-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-44-0x0000000002600000-0x0000000002607000-memory.dmp

          Filesize

          28KB

        • memory/1252-5-0x00000000029E0000-0x00000000029E1000-memory.dmp

          Filesize

          4KB

        • memory/1252-146-0x0000000077256000-0x0000000077257000-memory.dmp

          Filesize

          4KB

        • memory/1252-9-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-42-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-40-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-39-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-70-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-14-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-12-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-11-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-7-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-10-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-37-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-35-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-38-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-17-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-36-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-34-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-30-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1252-21-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1632-97-0x0000000000320000-0x0000000000327000-memory.dmp

          Filesize

          28KB

        • memory/1632-98-0x0000000140000000-0x00000001401B7000-memory.dmp

          Filesize

          1.7MB

        • memory/1732-121-0x0000000000220000-0x0000000000227000-memory.dmp

          Filesize

          28KB

        • memory/2076-85-0x0000000140000000-0x00000001401B6000-memory.dmp

          Filesize

          1.7MB

        • memory/2076-80-0x0000000140000000-0x00000001401B6000-memory.dmp

          Filesize

          1.7MB

        • memory/2076-79-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB

        • memory/2088-8-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/2088-0-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2088-1-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB