Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2024 02:35

General

  • Target

    82a4bc5335713f3201927604dc1c17fa.dll

  • Size

    1.7MB

  • MD5

    82a4bc5335713f3201927604dc1c17fa

  • SHA1

    0760fdf10d7b767e7b1c6c75b5a6df7fa582f2de

  • SHA256

    b24b5a97da7b45c297575085b7e6a6812e70391a8460609e4ab225c8b8c421b8

  • SHA512

    fdc555fae69369b3e61dae10b2e01607d5c853ed93bc403d08678447454e550ed598a3c46e4c7489e9e9626ffca57c317a92b64a3e48c6d44717667be684fe2e

  • SSDEEP

    12288:hVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:QfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\82a4bc5335713f3201927604dc1c17fa.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:828
  • C:\Windows\system32\Dxpserver.exe
    C:\Windows\system32\Dxpserver.exe
    1⤵
      PID:3056
    • C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe
      C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2436
    • C:\Windows\system32\MpSigStub.exe
      C:\Windows\system32\MpSigStub.exe
      1⤵
        PID:1372
      • C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe
        C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2888
      • C:\Windows\system32\rdpclip.exe
        C:\Windows\system32\rdpclip.exe
        1⤵
          PID:2064
        • C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe
          C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1464

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\3qL8\XmlLite.dll

          Filesize

          1.7MB

          MD5

          7ddea799917208e8c09706692f7b2b9d

          SHA1

          9cd88c64b018f42873252c13ed6bfd84e15658f9

          SHA256

          c15c3d6ce355c8fc5432cf6bb58b62a00c25966fc07a75a04e7f542f7dffa74d

          SHA512

          644b7937a28ee897dcd32cf69ebe242824bfecba19f20f846e29a03b94f3c2a0570402da756e8b3d3e9962c719f52527e3194d8dde0115022e435e79c159ecb8

        • C:\Users\Admin\AppData\Local\5mJA\WTSAPI32.dll

          Filesize

          1.7MB

          MD5

          ce077bd26ddf35a45bb35299dcfab262

          SHA1

          d5306e834f7fee74bc5181c8211c6f22441bf794

          SHA256

          9b2b07f731e4195112fa0da1a91f5f4496d5256c9d2af3602074642dac5a6d17

          SHA512

          dcff0f95e170155e7e3ec3f5f4e5b69df2b13c31e4ab4e3e0b3acb531ea2007301351cedd926436cb79561d026338a4a4d48fc022018c1bf6484b35419fe5d49

        • C:\Users\Admin\AppData\Local\nbYXZm\VERSION.dll

          Filesize

          1.7MB

          MD5

          4ebd2394fa6661a3583ec9e3e16438dd

          SHA1

          7491b01fc1e9b130a1381cd6b80d2a895a76e6bb

          SHA256

          4894a94be835028a32c05fb911e847fead89d36ad02970285d6da6e474af370d

          SHA512

          95b80b6fa08a815a7d4dd9335f21073e6f64e0fef1ed3e8d0500642ed67c12d29919e20a51fc3f1050d41ea44b1926fde878e168141f1ed91db8c7ad134991a8

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          efb971c697b8c2f47f4dce70769f9765

          SHA1

          79ce970a44f2693a788740dd289c438bd632d4c9

          SHA256

          0ac827ec4558c7f427a14b79d932050eee6b5ea4209abbc992f1336aeebd2247

          SHA512

          fe06c3ff7aed5d7620d4c178296f453558ad565221cbf384cff777b53d12d515ab3f4715bf3cca19c97246c934515476ef694197b9cf2491fbd7455cde962c9c

        • \Users\Admin\AppData\Local\3qL8\Dxpserver.exe

          Filesize

          259KB

          MD5

          4d38389fb92e43c77a524fd96dbafd21

          SHA1

          08014e52f6894cad4f1d1e6fc1a703732e9acd19

          SHA256

          070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73

          SHA512

          02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

        • \Users\Admin\AppData\Local\5mJA\rdpclip.exe

          Filesize

          206KB

          MD5

          25d284eb2f12254c001afe9a82575a81

          SHA1

          cf131801fdd5ec92278f9e0ae62050e31c6670a5

          SHA256

          837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b

          SHA512

          7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

        • \Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe

          Filesize

          264KB

          MD5

          2e6bd16aa62e5e95c7b256b10d637f8f

          SHA1

          350be084477b1fe581af83ca79eb58d4defe260f

          SHA256

          d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3

          SHA512

          1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

        • memory/828-1-0x00000000004B0000-0x00000000004B7000-memory.dmp

          Filesize

          28KB

        • memory/828-0-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/828-8-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-29-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-34-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-11-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-12-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-13-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-14-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-15-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-16-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-17-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-18-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-19-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-20-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-21-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-22-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-24-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-23-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-26-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-25-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-27-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-28-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-9-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-30-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-31-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-32-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-33-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-10-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-35-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-36-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-38-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-39-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-37-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-40-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-41-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-42-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-43-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-44-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-46-0x0000000002A70000-0x0000000002A77000-memory.dmp

          Filesize

          28KB

        • memory/1420-45-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-53-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-54-0x00000000773C1000-0x00000000773C2000-memory.dmp

          Filesize

          4KB

        • memory/1420-55-0x0000000077520000-0x0000000077522000-memory.dmp

          Filesize

          8KB

        • memory/1420-64-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-70-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1420-4-0x00000000771B6000-0x00000000771B7000-memory.dmp

          Filesize

          4KB

        • memory/1420-140-0x00000000771B6000-0x00000000771B7000-memory.dmp

          Filesize

          4KB

        • memory/1420-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

          Filesize

          4KB

        • memory/1420-7-0x0000000140000000-0x00000001401BD000-memory.dmp

          Filesize

          1.7MB

        • memory/1464-118-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/2436-83-0x0000000000080000-0x0000000000087000-memory.dmp

          Filesize

          28KB

        • memory/2436-82-0x0000000140000000-0x00000001401BE000-memory.dmp

          Filesize

          1.7MB

        • memory/2888-100-0x00000000000F0000-0x00000000000F7000-memory.dmp

          Filesize

          28KB