Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-01-2024 09:15

General

  • Target

    820d38a0c687ab0b550fe547c7bb1d6a.dll

  • Size

    1.7MB

  • MD5

    820d38a0c687ab0b550fe547c7bb1d6a

  • SHA1

    cf838d2bfcdc092fc2ed5d91225c487dbeaa0c54

  • SHA256

    9ddd12552dc5850ed10c847816d6e5f80272a66117d765587662065ede3435c5

  • SHA512

    a0786486bf985c7872c50c7e6a5af21ecee4295ec3fff1cae965d59422004bc00ce346e31c66a2af0c0481db634aeb87393dff80795f6a57903ee3f17426ca4e

  • SSDEEP

    12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\820d38a0c687ab0b550fe547c7bb1d6a.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:808
  • C:\Windows\system32\sessionmsg.exe
    C:\Windows\system32\sessionmsg.exe
    1⤵
      PID:3884
    • C:\Users\Admin\AppData\Local\wpn\sessionmsg.exe
      C:\Users\Admin\AppData\Local\wpn\sessionmsg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4576
    • C:\Windows\system32\dccw.exe
      C:\Windows\system32\dccw.exe
      1⤵
        PID:1824
      • C:\Users\Admin\AppData\Local\R1h0gsZFF\dccw.exe
        C:\Users\Admin\AppData\Local\R1h0gsZFF\dccw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4332
      • C:\Windows\system32\MDMAppInstaller.exe
        C:\Windows\system32\MDMAppInstaller.exe
        1⤵
          PID:5048
        • C:\Users\Admin\AppData\Local\qVQpmj3\MDMAppInstaller.exe
          C:\Users\Admin\AppData\Local\qVQpmj3\MDMAppInstaller.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1260

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\R1h0gsZFF\dccw.exe

          Filesize

          101KB

          MD5

          cb9374911bf5237179785c739a322c0f

          SHA1

          3f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9

          SHA256

          f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845

          SHA512

          9d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be

        • C:\Users\Admin\AppData\Local\R1h0gsZFF\mscms.dll

          Filesize

          1.7MB

          MD5

          8032a92f3ede3f3542a8802771de4d7e

          SHA1

          300a1d579bd19d70d0a4d199fa99b63d422207f9

          SHA256

          21b8c24ffc372558361325d00e4525b8d51c52d0354019b9ef2e7297566f003f

          SHA512

          8331352ae78bb534e52d16fbc4b4825e61f0fb8c1803a29a878ff92c9d2c26033ae70cd2a872296646f7067c557ce49f53322d55f4d90c6e6db3f9bbb11b3602

        • C:\Users\Admin\AppData\Local\qVQpmj3\MDMAppInstaller.exe

          Filesize

          151KB

          MD5

          30e978cc6830b04f1e7ed285cccaa746

          SHA1

          e915147c17e113c676c635e2102bbff90fb7aa52

          SHA256

          dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766

          SHA512

          331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214

        • C:\Users\Admin\AppData\Local\qVQpmj3\WTSAPI32.dll

          Filesize

          1.7MB

          MD5

          e75203ab9f762c9852de779891c2ddca

          SHA1

          7c9001ab6b7dba99c54fe1a352a54c6676666155

          SHA256

          9c75e61519315306935d5b3f0173cfd82ebe89144a19ec7c45f5096532c481a0

          SHA512

          bd234c922234dc86eee62588537a09662f675414a3340c29d7cd5b92a45f217e093a5dedc03d71fdaccc9f1eaa0f2c1862d64199ab8456e0f441a0a0dbbb21e1

        • C:\Users\Admin\AppData\Local\wpn\DUI70.dll

          Filesize

          2.0MB

          MD5

          8ce13a32b1bc8d8bb19d1981b63cc083

          SHA1

          61f2d66a79d35dcda913dfcb9878011e2b07d95f

          SHA256

          be23c8c28d6e2930f67e78af7230c2dfaf40219e2f6e7d982abb82981b8b4d34

          SHA512

          7e2136aa018c06703e0d35dab08796419d3859202651836c42cac033234cb67238c535966c280eadd5edb0a9e8b891023a74e195a97b3165ab3319c3db289ff8

        • C:\Users\Admin\AppData\Local\wpn\sessionmsg.exe

          Filesize

          85KB

          MD5

          480f710806b68dfe478ca1ec7d7e79cc

          SHA1

          b4fc97fed2dbff9c4874cb65ede7b50699db37cd

          SHA256

          2416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc

          SHA512

          29d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

          Filesize

          1KB

          MD5

          550d3b2e73425dba59bbd3a29ce1ec65

          SHA1

          154f363d646ca05959bafec385ef3b480fa8f2b0

          SHA256

          e706e5d87e304e17747815909027c76296b61f63d477e33e2627dbca187e3194

          SHA512

          183c416b9ac67dddc11379bce8578eda851a56ce8f29cc02281a55029428185d23c617083ec2b2cd1a8d5e0b069ee09ff21d93039d4509f206f6724eae0e4c65

        • memory/808-1-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/808-0-0x000001EC62F40000-0x000001EC62F47000-memory.dmp

          Filesize

          28KB

        • memory/808-8-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/1260-108-0x00000181E0100000-0x00000181E0107000-memory.dmp

          Filesize

          28KB

        • memory/1260-107-0x0000000140000000-0x00000001401B6000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-18-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-38-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-17-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-15-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-19-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-20-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-21-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-22-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-23-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-25-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-24-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-27-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-28-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-29-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-30-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-26-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-31-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-32-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-33-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-34-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-35-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-36-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-37-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-16-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-40-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-41-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-39-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-43-0x0000000000E00000-0x0000000000E07000-memory.dmp

          Filesize

          28KB

        • memory/3444-42-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-50-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-51-0x00007FFB69840000-0x00007FFB69850000-memory.dmp

          Filesize

          64KB

        • memory/3444-60-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-62-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-14-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-13-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-4-0x0000000001080000-0x0000000001081000-memory.dmp

          Filesize

          4KB

        • memory/3444-6-0x00007FFB68C7A000-0x00007FFB68C7B000-memory.dmp

          Filesize

          4KB

        • memory/3444-10-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-12-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-11-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-7-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/3444-9-0x0000000140000000-0x00000001401B5000-memory.dmp

          Filesize

          1.7MB

        • memory/4332-94-0x0000000140000000-0x00000001401B7000-memory.dmp

          Filesize

          1.7MB

        • memory/4332-89-0x0000000140000000-0x00000001401B7000-memory.dmp

          Filesize

          1.7MB

        • memory/4332-88-0x000001C649DB0000-0x000001C649DB7000-memory.dmp

          Filesize

          28KB

        • memory/4576-77-0x0000000140000000-0x00000001401FB000-memory.dmp

          Filesize

          2.0MB

        • memory/4576-71-0x0000000140000000-0x00000001401FB000-memory.dmp

          Filesize

          2.0MB

        • memory/4576-72-0x000001E5DDCE0000-0x000001E5DDCE7000-memory.dmp

          Filesize

          28KB