Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2024 04:04

General

  • Target

    85e07e2192815cfa564f16edf062c8af.dll

  • Size

    2.2MB

  • MD5

    85e07e2192815cfa564f16edf062c8af

  • SHA1

    843a10890c2c0c2df9d3bf43de2334cf020726d9

  • SHA256

    04952d47ce4e62e8f4c7917d557ae78e8d6944b20d050e33444f5dfae68e784c

  • SHA512

    45e193918f286b142000ca3a66afbc204262c0d03b88f5e54bf991aa8a5addb15e762a6dfaf9a1ace4ea0ede4a9afdb7297f894d9aa6e2d64f2ae106f21a5396

  • SSDEEP

    12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1oeGf:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnbod

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\85e07e2192815cfa564f16edf062c8af.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1888
  • C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
    C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
    1⤵
      PID:2468
    • C:\Users\Admin\AppData\Local\jAmCYAP\WindowsAnytimeUpgradeResults.exe
      C:\Users\Admin\AppData\Local\jAmCYAP\WindowsAnytimeUpgradeResults.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2484
    • C:\Windows\system32\sethc.exe
      C:\Windows\system32\sethc.exe
      1⤵
        PID:888
      • C:\Users\Admin\AppData\Local\4tE\sethc.exe
        C:\Users\Admin\AppData\Local\4tE\sethc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1276
      • C:\Windows\system32\dwm.exe
        C:\Windows\system32\dwm.exe
        1⤵
          PID:2784
        • C:\Users\Admin\AppData\Local\cBKyOYRb\dwm.exe
          C:\Users\Admin\AppData\Local\cBKyOYRb\dwm.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2640

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\4tE\DUI70.dll

          Filesize

          2.4MB

          MD5

          ef0b0d8f89e64cb40fdb07cf91af0b68

          SHA1

          425bbc2d953396b877e844a92bba76d69ac22d80

          SHA256

          85ffe28aa02a2efe6152c6f7250550a85e15489bd1c8911d73a6490794d40080

          SHA512

          1da1e70132a1a855c008572d3d4365144c4f72361c02559fb99575d3c2a10a959f4fd9481c94394f99570b7619de6875174ecc10c83bfc1e7d6add9a888e5a48

        • C:\Users\Admin\AppData\Local\cBKyOYRb\UxTheme.dll

          Filesize

          1.7MB

          MD5

          65f5a84c46844caaad4e7c47e4604d88

          SHA1

          38f9e076103e3f04426948df916481b56c14d303

          SHA256

          dbf049d03471c4c8fbf5a7e1de43dc3d49fdc5d2fd7f94e5e69a26c0bf1ae28f

          SHA512

          760ba61764810ee8ba4ffa1f4c62a12f627bff308097727a875bfc36844e536e1cf880c3e137e362e543c3cd7dbf570916000b747ac66c63cc1182ab9b6fbfe0

        • C:\Users\Admin\AppData\Local\jAmCYAP\WINBRAND.dll

          Filesize

          2.2MB

          MD5

          4f4e54e8ab625db901bd3df5d887b4f8

          SHA1

          710dd287b638a2dc0a975a7bb5cb5775399fbf08

          SHA256

          ec64b706d3bde230d72bffcd868a4d5f2d8a69d2abc4735cd02ff32bf8cd0898

          SHA512

          fa71065885cc355b3e45b1f46c23ae5357a36b9c23954896e0fb2077c60a8c82d3895ad7d8f614fde4ff5c22c727b73408e4d551c41d77968578ef14b080b2cc

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

          Filesize

          1KB

          MD5

          ea3b27e3c973ec7af3d79fc4c35e96b9

          SHA1

          61d6c31ab624afe08557896db0f6d288b52bcd18

          SHA256

          231282b607319060bb9d4ad53aa0725a9dcd3cc19e5ad0367ab75696fb93852d

          SHA512

          24e60e84ab935406b14f41ec83b33562c467b065630a32662f3441e6e51a9f398858ab80b93956c0b23910fa25b72144f093966a1753cbf229c42804c0321b8c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\78Yi6Z\UxTheme.dll

          Filesize

          2.2MB

          MD5

          5b21da464ed5994482015690552183ed

          SHA1

          f45fb4d0acddac2eaf82482b2361f04b9810f3fe

          SHA256

          f1ad5596cbe73c9f8cb93190a79435bf32fa212b11b9f4d41c4c40aad42fa93d

          SHA512

          d1367a2aebc7c3aaa81d5e762d6e076d43923cad331dc11d97fb93eb3b058d12e5a9981eda982371ac4112cd871c1e72089bc9db3a3916a13f7f044505ff4e87

        • \Users\Admin\AppData\Local\4tE\sethc.exe

          Filesize

          272KB

          MD5

          3bcb70da9b5a2011e01e35ed29a3f3f3

          SHA1

          9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

          SHA256

          dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

          SHA512

          69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

        • \Users\Admin\AppData\Local\cBKyOYRb\UxTheme.dll

          Filesize

          1.1MB

          MD5

          a576490dfd0c9f2b4e21c550c9a2058e

          SHA1

          808c99319e33c295ae72cc5365313a4db91b0a5c

          SHA256

          37a9b11aa8e46214dd67c06a68b673ce161e7601d6c8d6fed02799b75bb552f7

          SHA512

          2bde81d1103a76285701eee281fb892943d9a3103c68b6c79eaecdf9ab72772001541e083638739d1b1c3f5455eb58fcc7519f6f488800b28fb0f43badb76060

        • \Users\Admin\AppData\Local\cBKyOYRb\dwm.exe

          Filesize

          117KB

          MD5

          f162d5f5e845b9dc352dd1bad8cef1bc

          SHA1

          35bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2

          SHA256

          8a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7

          SHA512

          7077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851

        • \Users\Admin\AppData\Local\jAmCYAP\WindowsAnytimeUpgradeResults.exe

          Filesize

          288KB

          MD5

          6f3f29905f0ec4ce22c1fd8acbf6c6de

          SHA1

          68bdfefe549dfa6262ad659f1578f3e87d862773

          SHA256

          e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b

          SHA512

          16a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e

        • memory/1276-94-0x0000000140000000-0x0000000140267000-memory.dmp

          Filesize

          2.4MB

        • memory/1276-89-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/1276-88-0x0000000140000000-0x0000000140267000-memory.dmp

          Filesize

          2.4MB

        • memory/1384-31-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-17-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-20-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-23-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-22-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-21-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-24-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-25-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-26-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-27-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-29-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-28-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-30-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-32-0x00000000025C0000-0x00000000025C7000-memory.dmp

          Filesize

          28KB

        • memory/1384-4-0x0000000076FE6000-0x0000000076FE7000-memory.dmp

          Filesize

          4KB

        • memory/1384-39-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-40-0x00000000771F1000-0x00000000771F2000-memory.dmp

          Filesize

          4KB

        • memory/1384-41-0x0000000077350000-0x0000000077352000-memory.dmp

          Filesize

          8KB

        • memory/1384-50-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-54-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-56-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-19-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-18-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-5-0x00000000025F0000-0x00000000025F1000-memory.dmp

          Filesize

          4KB

        • memory/1384-12-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-11-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-10-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-9-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-7-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-16-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-15-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-14-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1384-13-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1888-8-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1888-0-0x0000000140000000-0x0000000140233000-memory.dmp

          Filesize

          2.2MB

        • memory/1888-1-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/2484-74-0x0000000140000000-0x0000000140234000-memory.dmp

          Filesize

          2.2MB

        • memory/2484-68-0x0000000001B50000-0x0000000001B57000-memory.dmp

          Filesize

          28KB

        • memory/2484-69-0x0000000140000000-0x0000000140234000-memory.dmp

          Filesize

          2.2MB

        • memory/2640-109-0x00000000001A0000-0x00000000001A7000-memory.dmp

          Filesize

          28KB

        • memory/2640-114-0x0000000140000000-0x0000000140234000-memory.dmp

          Filesize

          2.2MB