Malware Analysis Report

2024-11-13 16:41

Sample ID 240202-h6hwasagbl
Target 88e7c4c98a35a8043d0fb99f1b88898a
SHA256 9af7f7a4d19d0327bdddeff74e7cc37b1eda5272fdf1853d54708c72c28178d1
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9af7f7a4d19d0327bdddeff74e7cc37b1eda5272fdf1853d54708c72c28178d1

Threat Level: Known bad

The file 88e7c4c98a35a8043d0fb99f1b88898a was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-02 07:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-02 07:20

Reported

2024-02-02 07:23

Platform

win7-20231215-en

Max time kernel

150s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e7c4c98a35a8043d0fb99f1b88898a.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Niubkzso = "C:\\Users\\Admin\\AppData\\Roaming\\MEDIAC~1\\IKBQXX~1\\javaws.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1248 wrote to memory of 2436 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1248 wrote to memory of 2436 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1248 wrote to memory of 2436 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1248 wrote to memory of 2116 N/A N/A C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe
PID 1248 wrote to memory of 2116 N/A N/A C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe
PID 1248 wrote to memory of 2116 N/A N/A C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe
PID 1248 wrote to memory of 2268 N/A N/A C:\Windows\system32\javaws.exe
PID 1248 wrote to memory of 2268 N/A N/A C:\Windows\system32\javaws.exe
PID 1248 wrote to memory of 2268 N/A N/A C:\Windows\system32\javaws.exe
PID 1248 wrote to memory of 280 N/A N/A C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe
PID 1248 wrote to memory of 280 N/A N/A C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe
PID 1248 wrote to memory of 280 N/A N/A C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe
PID 1248 wrote to memory of 780 N/A N/A C:\Windows\system32\msra.exe
PID 1248 wrote to memory of 780 N/A N/A C:\Windows\system32\msra.exe
PID 1248 wrote to memory of 780 N/A N/A C:\Windows\system32\msra.exe
PID 1248 wrote to memory of 976 N/A N/A C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe
PID 1248 wrote to memory of 976 N/A N/A C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe
PID 1248 wrote to memory of 976 N/A N/A C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e7c4c98a35a8043d0fb99f1b88898a.dll,#1

C:\Windows\system32\rdpshell.exe

C:\Windows\system32\rdpshell.exe

C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe

C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe

C:\Windows\system32\javaws.exe

C:\Windows\system32\javaws.exe

C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe

C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe

C:\Windows\system32\msra.exe

C:\Windows\system32\msra.exe

C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe

C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe

Network

N/A

Files

memory/2536-1-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/2536-0-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1248-4-0x0000000077416000-0x0000000077417000-memory.dmp

memory/1248-5-0x0000000002950000-0x0000000002951000-memory.dmp

memory/2536-7-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-8-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-10-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-12-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-14-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-13-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-16-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-20-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-21-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-19-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-17-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-24-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-25-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-26-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-28-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-27-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-22-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-31-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-32-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-29-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-33-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-34-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-36-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-37-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-35-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-30-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-38-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-23-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-39-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-18-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-40-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-42-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-43-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-45-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-47-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-48-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-46-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-44-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-49-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-50-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-41-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-51-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-52-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-53-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-54-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-57-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-59-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-58-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-60-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-61-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-56-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-62-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-55-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-63-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-65-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-64-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-68-0x0000000002720000-0x0000000002727000-memory.dmp

memory/1248-15-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-11-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-9-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/1248-76-0x0000000077621000-0x0000000077622000-memory.dmp

memory/1248-77-0x0000000077780000-0x0000000077782000-memory.dmp

C:\Users\Admin\AppData\Local\84PBsYS6r\WTSAPI32.dll

MD5 c70d28eddf23fe127fc66c6dfc5d4a45
SHA1 6eb5c0ddd213bd7c45a2777afdbab06522db1c01
SHA256 5076da204f9cdfc8faaffc90ac81713753a73a5401da983395150888eef631c5
SHA512 84e54446d6232aaad3e0828e3ee34e4d07a51eaaea378c6d360fe3f3110f690a1b7379059c736be9b2ac23b0e0bcc7e60357acf7a4d1bd99d47dc25af35c6f2c

\Users\Admin\AppData\Local\84PBsYS6r\WTSAPI32.dll

MD5 68d799c15a18969be13476b2e89b2a9b
SHA1 7cf73bb556ca645bf756e736c55ea113c889f1e6
SHA256 c75599f2bef555aa1ac6ccc103d136f2e3cbd18c3b147fdd25616b262a6ae67b
SHA512 50372bce220f86989b9b7f38b82ebbcc283a6d5151a9bb3e4af4cacfae6ab0e004b45bc179fe87e7e550a9c1995800c2435e1dc31ecd4c8d3b2ce011e5e4f91c

memory/2116-104-0x0000000000080000-0x0000000000087000-memory.dmp

C:\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe

MD5 783db0cf5829c3754a00b5437e18f7ae
SHA1 bc068f563123ad94e651204689681c96d380fcbd
SHA256 52265ac3e5c854cf58e5d40581099236c023f2471d1291d770fbd242a8a3b19e
SHA512 ad6a076c04d1d4e75e7e52129c38b6e44dca91d7fcfbd42b7466519f77762c1bf583898d962ddd1eec7cb02a54ebbe8fe766bf79054a37978793cb08f18cb261

\Users\Admin\AppData\Local\84PBsYS6r\rdpshell.exe

MD5 e8374257eb20fceddc183fa8b45d30ca
SHA1 2215e1d38f9146320d5311aa5885144bd061d046
SHA256 393be3a4eb29752f1dccd7bf90783584d1c1c5ef5b5506dc30ee457fb88b853f
SHA512 ff70b3ab471e3db1a6c7c4305c2d58d993346c38a3ea02d025ce8f127b4cee259f0de60faaafab23eae3ab2a079a58ba2aee3cf53e89f0e582171fccbf49a252

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\aFioVcjD8\rdpshell.exe

MD5 a62dfcea3a58ba8fcf32f831f018fe3f
SHA1 75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256 f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA512 9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe

MD5 f94bc1a70c942621c4279236df284e04
SHA1 8f46d89c7db415a7f48ccd638963028f63df4e4f
SHA256 be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c
SHA512 60edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52

C:\Users\Admin\AppData\Local\M9yQGCiq\VERSION.dll

MD5 9269569dbed4d34f6086ad8d174cc18d
SHA1 b79dfe01cf424bb4ac114b773a401f520daf358d
SHA256 94dd365556bc7fc62086038ba62ac8075247b36274bfc9c40bc84c4b3a5ff307
SHA512 455feafcb511e9bce9126f73e7a84f209a40a12480395e9e30be66cded630acc175e4e4ab99ef9c88d5625fdcbecf4f241621fee6fcfcd8d370ec610cbf25591

\Users\Admin\AppData\Local\M9yQGCiq\VERSION.dll

MD5 457de880a710f35e3c9363a72014a3cb
SHA1 bccd464e20f96a7df3532b89f9765d0dfa8746ef
SHA256 dd2e893a69470bb713d79d7d3f7cdfd4db4ab3160f6e5e6827ad56a9a1b52955
SHA512 d5ba80c6685846162fd337a34a0d0770018759e0da4d142678d5497f67103fad84d65f0f30337ccc0b7432d8623b55100bdaf7ead81795f3e27650e784c413a0

\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe

MD5 c55fd5c925fe023faf5bd664b9e42197
SHA1 8f46780abda95559b209dcd4b0154824941f2d61
SHA256 00bf1b62df0800f83c4ab863a4123ce63f109e86637df819c3762769ac2fae0a
SHA512 52297e59e9c80ee2db72903e46c35c853c469abc3452350415ba95a0ed8c84537decf80d11b86c70537910de74bd875d548ba672a5afbd6c2e87f96399d0a0c6

memory/280-121-0x00000000000F0000-0x00000000000F7000-memory.dmp

C:\Users\Admin\AppData\Local\M9yQGCiq\javaws.exe

MD5 04de78c5b4a0d975ae606983ccf091a8
SHA1 3a26c5ff29959b20b21131ac93d0d4fa96fa9fb6
SHA256 1581dc1758b9165e1760cad7de17655e9e0bc2bdf9928f9e0f503c50c52fb3e2
SHA512 cfefa4db84b1a684584125a98282faefbf12694436539a763540c945ff7772aa3e1ca1d588bda365d97561604951ae21e20a89696eb81200e29099715b1fe8b1

\Users\Admin\AppData\Local\XVBg8RN\msra.exe

MD5 0fb60bc64fae7cec780513fb047385bc
SHA1 92572d0aff364ccd15949b53ba4d2871942c20b4
SHA256 4c683a0b1f011fa7d15f026ca6896c9f307106e953655ce69ef3bdb2c069f5d6
SHA512 16356e381bcdac69bf5bfb9acd53444453f96f6a30671dc39371406dbda2ba2e9f33522633085451cb92aa49aeeadcf6a945827d97d38ea81e5db5801c0acd0e

\Users\Admin\AppData\Local\XVBg8RN\UxTheme.dll

MD5 d4a637cefbc53073f6401ac85187d972
SHA1 3d30140dfaf9f4f7d36bccb2ab48694e30a54703
SHA256 58d4a8d3a56f41b5126f1d5dc91a50e9a9baa188d6c823901e3546be192007ae
SHA512 d40a017f7ef773571bd8c93ea0b4d6cdd6dcda39aa793526d4eba8ddf511bf3e96cbfe63c464f61e2c590094f9ad741b849e6694d6d692644f6fcd165f3e4a4f

C:\Users\Admin\AppData\Local\XVBg8RN\UxTheme.dll

MD5 603d3623b7dd0955d38f508669bdff1e
SHA1 d09c16f1bea8ddde36c816719bb3b89a56c6f253
SHA256 03142f361832acbd234fbeb0c2d9cf657b8198f32e03b3c9e6af7f2f4c3f1436
SHA512 2ff259826155cd6e5b6ea066c5786ea1f7fb0a2346a1fa4dc8989b27084fbb1ddcec418ee4f9ffb52580f33c424c648224a29ca2d2b922e166e1f013e0c3d0e4

memory/976-139-0x0000000000290000-0x0000000000297000-memory.dmp

C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe

MD5 948c145a266120aacfbb544c6792e98c
SHA1 8c84b9de7a6f70d31baf990130b26140968bc932
SHA256 5c27210e00b1c840773bf2d48fac93c1d9a05be5c1a28f0d19a861de1600f85d
SHA512 0ad7b974c7d82ed72d303d53a33b659e3e5111ebc12f106cd2c0f6b2fa769100da99068b198624e61f41f0c5fc20eb3faf36488c1c703278458911017e95b216

C:\Users\Admin\AppData\Local\XVBg8RN\msra.exe

MD5 4deb443842c8b9d50e20a87a5f118929
SHA1 935f4d9573bc4df61ea6023849a46e163a64e9ca
SHA256 8e3d847e7052bfefe88befee3f31cec46b801dff41687b4254997857f59782df
SHA512 e684c3f3312e857dd3ea7b3f8f5a7fda0729f22865307b2a237d6867f25dafa9089bb0a968ea94250b8fd996bb173ca2ebe1fd8d09b9915dd43296e6c5cfb54b

\Users\Admin\AppData\Roaming\Microsoft\Credentials\nI\msra.exe

MD5 ebbb6a9f4cd86df2f1491457ff7165ae
SHA1 c1ab32500bf96f0ae18a0174fe187f592a5ce095
SHA256 3f667630e515e3ee4ed98d48a8e29bef2932d32c9e34c36b9d0d885f147a940a
SHA512 8d6503191ce7f724bbd6d9c92ba5b2e82864c130b97577f90c5a40f6961c094a759003dd70a3c381dad67e5de4ad96e072b3b278a557c7c8fb12967b2f4fe567

memory/1248-162-0x0000000077416000-0x0000000077417000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Efrsxj.lnk

MD5 7344cfcd81a98e6ca86f00d065f7b867
SHA1 06e3c373f6bc90e7eb77723e3279eace214c5467
SHA256 8552166a6f97f5f64dd4ca55c1b0d03685971d6a4207975cb6cd443fcd482727
SHA512 0fc4503c20b82a46fb603c0130de8cb92a119e06861908df239449ce59c7e04e634f6e89efdfb7b1913f7f74964cbb1517a81601f4fa7d9e26cb8ef8185c8edf

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\aFioVcjD8\WTSAPI32.dll

MD5 f80d2338308309b8908a18547ab4c0d1
SHA1 cf7bbced72080eeb710447657f1178346003c538
SHA256 1480747ed24939416458ab7ca82c83100c350e33bc82e18f1b03ecc343347755
SHA512 0b2025ef56421d38e91e2bbb8dc7e1ca10da6da55c86925fe00f4b433175511172bf5d03de7f3573e61f8244d46651e0c949622279715b111ba9d9f6ede7d03a

C:\Users\Admin\AppData\Roaming\Media Center Programs\iKBQxX3nnT\VERSION.dll

MD5 50379f37b464c9ae1198369356af7291
SHA1 62b6afd151d70ac743a90fd6300b555cfe63870b
SHA256 8ddef1edb4b0fe6a0d74da2c9434bc429593b61058357fc71c0ae4e34c1fb39f
SHA512 324fdbb680d17f0509d9249b427abf2ab43ee1caa8c5c3f5bbf78fb1057332edd816fba39919b74622a2ddf549d400cdc05e9002151e4325197ddf9b5c89b60c

C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\nI\UxTheme.dll

MD5 1e3a342b1cb99c1f3f8a67eda6184a83
SHA1 85dde84d415c847bea280e96204a8b03bc2cbda3
SHA256 0042ca1c14b0b35f06a685e1243f9f1f9ae591dd46922b82dcedb3b442951e66
SHA512 fd843247287d3ea7320a065e75786e70eb8fe7f9dbc849a71f750c8cbe4a0875ff1669fe31b31753f2043c74a7836215bf62657c6a357ef456608948199e7403

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-02 07:20

Reported

2024-02-02 07:23

Platform

win10v2004-20231222-en

Max time kernel

149s

Max time network

149s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e7c4c98a35a8043d0fb99f1b88898a.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tgnmvdx = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\l1quSq\\PresentationHost.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3548 wrote to memory of 728 N/A N/A C:\Windows\system32\SystemPropertiesRemote.exe
PID 3548 wrote to memory of 728 N/A N/A C:\Windows\system32\SystemPropertiesRemote.exe
PID 3548 wrote to memory of 1744 N/A N/A C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe
PID 3548 wrote to memory of 1744 N/A N/A C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe
PID 3548 wrote to memory of 1564 N/A N/A C:\Windows\system32\PresentationHost.exe
PID 3548 wrote to memory of 1564 N/A N/A C:\Windows\system32\PresentationHost.exe
PID 3548 wrote to memory of 4112 N/A N/A C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe
PID 3548 wrote to memory of 4112 N/A N/A C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe
PID 3548 wrote to memory of 2872 N/A N/A C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
PID 3548 wrote to memory of 2872 N/A N/A C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
PID 3548 wrote to memory of 3660 N/A N/A C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe
PID 3548 wrote to memory of 3660 N/A N/A C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e7c4c98a35a8043d0fb99f1b88898a.dll,#1

C:\Windows\system32\SystemPropertiesRemote.exe

C:\Windows\system32\SystemPropertiesRemote.exe

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe

C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe

C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe

C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe

C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe

C:\Windows\system32\PresentationHost.exe

C:\Windows\system32\PresentationHost.exe

C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe

C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/2776-1-0x000002F7E3E00000-0x000002F7E3E07000-memory.dmp

memory/2776-0-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-5-0x00007FFC5892A000-0x00007FFC5892B000-memory.dmp

memory/3548-4-0x0000000006E40000-0x0000000006E41000-memory.dmp

memory/2776-8-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-7-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-9-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-10-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-11-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-12-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-13-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-14-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-15-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-16-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-17-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-18-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-19-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-20-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-21-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-22-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-23-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-24-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-25-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-26-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-27-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-29-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-33-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-35-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-38-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-40-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-42-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-44-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-46-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-48-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-50-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-49-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-47-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-45-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-43-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-41-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-39-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-37-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-36-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-34-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-32-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-31-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-52-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-55-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-58-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-61-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-62-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-64-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-65-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-63-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-60-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-68-0x0000000001F30000-0x0000000001F37000-memory.dmp

memory/3548-59-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-57-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-56-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-54-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-53-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-51-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-30-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-28-0x0000000140000000-0x00000001402A8000-memory.dmp

memory/3548-76-0x00007FFC58D20000-0x00007FFC58D30000-memory.dmp

C:\Users\Admin\AppData\Local\iTHmgL96Y\SYSDM.CPL

MD5 bb7c2d8169f0f164b88e376382c93254
SHA1 7da98bc9c4cafb3c4c3f5cbccfbf775b812322ca
SHA256 5c215f387df01b17306d16230b2d6651238c9c3d1a7d3922159cd8c3c58520ce
SHA512 18663b55d39aa4a8197e23cd4e5026736082eb4a0236cf3475ab5475c49808d376d063b64c935997919d6d0fdbade6277edb43b35684a7177e7a29178ea18956

C:\Users\Admin\AppData\Local\iTHmgL96Y\SYSDM.CPL

MD5 316bbfda614af2a329ccebec80179284
SHA1 4dae5670fc147ad5ed42d5f816cbf670047d4063
SHA256 d141fca90242a5c1248b7394301a9868c0e4a65aec890d0ff84dcf954cffdd89
SHA512 d4cdd7b122ff35c6fec3127eb24a3b44b608ba194e880a891ff50813f0df0361e05d4fe05941c5f04bebf592502ec5539abc1835e57816a08c58b8bfc856705f

memory/1744-98-0x000001745C9C0000-0x000001745C9C7000-memory.dmp

C:\Users\Admin\AppData\Local\iTHmgL96Y\SystemPropertiesRemote.exe

MD5 cdce1ee7f316f249a3c20cc7a0197da9
SHA1 dadb23af07827758005ec0235ac1573ffcea0da6
SHA256 7984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512 f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26

C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe

MD5 1df762097651f773e2b444f5f254a01c
SHA1 ace9d081bcecbceaca5ca971a443aaf6feed3052
SHA256 af7ba208e82b49694ac6060d923e2362a9c4b4d4b9965955d61915fca90ada82
SHA512 81b9406169f08084aa4c6e2e9f2e7da5fec3e14906c4cff91b14e0ef25c300d01f14004164549ccc4e3826600a5fc13f64bbae4f658873dd8b866facee339a42

C:\Users\Admin\AppData\Local\rvfa\VERSION.dll

MD5 45db05affaabbe3dc6be67a4dc4a6afc
SHA1 e58c3548c98d36e4037252e1a52a3a7e1027fe18
SHA256 ec75cca13641aea341c0093773747e68d4c40c710722cb5be4a16bf78dcd649b
SHA512 86dddf7ee9da0289a2b0c0d5f2091a3f49c8f050e50b04f1b40b557669020be58dadd5764fd364cb6b113d80178bfe44d31aa87fc8b02137e4ae9d748582a8a6

memory/4112-117-0x0000016C90690000-0x0000016C90697000-memory.dmp

C:\Users\Admin\AppData\Local\rvfa\PresentationHost.exe

MD5 43c70ab6cc578d2a651cd568b99dc3e5
SHA1 7931b17b579c5055419053b898d096f0b527d807
SHA256 2e1208b294d4f56cc411a32c7a481078e7cb404dab729587cb3be985dd5389b7
SHA512 30e9e2592b2b8c4b34ae38275b0d1c9476276a96a1c056ea7b548cda240fdf15fb0779880e69b796f6efda1e9b6f19f159bddf6157a4e8cfe5fa2bb5bd623aa3

C:\Users\Admin\AppData\Local\RbzX\SYSDM.CPL

MD5 7179efd9dcfd9c431ff4e1aa8ba436af
SHA1 8f7639fed1dfbb7e3771ec65a2dc7fcae827f492
SHA256 27db48702ba3762e172f158a24c4850b6ecf584578131fb49811fb4048866c31
SHA512 354077f5bd5515f3df541204cf57dd69daad5dd6df98f712452619daf86c23f3f279726734b45d6e4716e1a36394f54f3a5f3df9b4f293d88d00f9651cc046f5

memory/3660-131-0x000002296C6C0000-0x000002296C6C7000-memory.dmp

C:\Users\Admin\AppData\Local\RbzX\SYSDM.CPL

MD5 b457b62cc9e6e8ed883944ebac2b04b7
SHA1 cad04c99d6da4d9d1dcc6d030e12eae5d521230e
SHA256 28cf4ab6d246e2c1b211f3186d72e4f9c3c298bf234be20ce11be5365f497832
SHA512 f43f3f8783a96fecc1816a4f8837eed6ba79d4f9a1a57f54e39d6aae9bdef630bf1b223c2ed8f500ec24902bb556d90bb90c1e4f964044cc68107202c33d2e4c

C:\Users\Admin\AppData\Local\RbzX\SystemPropertiesDataExecutionPrevention.exe

MD5 de58532954c2704f2b2309ffc320651d
SHA1 0a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA256 1f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512 d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed

C:\Users\Admin\AppData\Local\rvfa\VERSION.dll

MD5 7c94a15b1006d48f46021ddafa2ae348
SHA1 a6bbcea3ec401197702c92caf895f7be58b67327
SHA256 72d6baebb2defa7927fd575a17501a730e7473d249dea5f00138831fe7fbb24f
SHA512 b7cff4d1c32a2c3f70e7c08494ba182b3058e67141bc89df6619bc16021f62a4262caecfd3e9580dae20a5058140f79d61331c4419738367ee75d71aa304311a

C:\Users\Admin\AppData\Local\rvfa\VERSION.dll

MD5 aa8ca50e8f18b40df19b960c56f81579
SHA1 e050826b1d5bd43363f53dc93e38680f027c1496
SHA256 f3563cf09642096baea99b2227bf0ad82ed8d5e74fc6bb6cec24e370ccf6eee1
SHA512 6ad9b5d9836f74fa388022cb5c3078d3d9cb0c0a3e204e005b5ad9ece3473c9840573768f8e817028c31145a6bea8b4d16e25463239300a202d5862e4e8bf75a

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqwbkkvq.lnk

MD5 ada73b4215811d72d11346c16a54acf2
SHA1 4ecffeb199c2b61fba9fc5b8629ed65b8f88a4e0
SHA256 1b4263224d37494f7d44f32b6a52260e2506d770d39f1d3ea2bd390de14fe63b
SHA512 58bd2c97c528812381c8a33aec8e3b16a092224af34dafeaafbedbe3b97051539eefb60ec3047f78a5c8a9aa7fb24516912a8144613eacfcd253f90e2aaa28fa

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\LwU\SYSDM.CPL

MD5 93883646947bfbe1bbfae9eefaaaa3d4
SHA1 8ab30699b5705d8748f23a85776c840e45bdccf0
SHA256 bbbded9c6f5ae0a20d571e32a42681bf41653a83758822525155527c81970078
SHA512 a9a2e8b09d996282c0e34215e40772fbece8f1207f892391cdb8f4d8c0377caf44a4ae86770403c1e0d88c4be56a3816ecc042a96521f1daa95b156a805fc8e2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\l1quSq\VERSION.dll

MD5 730abe2373b4f3e3c6ca10288cf9ea23
SHA1 ac1f0218ecf44a2046278bd6011e3760b5a25772
SHA256 d1035153139ac2d879a67d2b8888d8d730812ee9a9730ceb047aa9ea5574c2c2
SHA512 97f4e17641333c5b1892d73f832e56dbf36344a03b6049bd22afefe53331e77f88d0ab686912f7c169b4399abfbe4c49d5b4b9085f85d55f4bd49cfe99319bc7

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fwiWxm\SYSDM.CPL

MD5 a649bac21a9678e1de93db3d0bf155d6
SHA1 794428c801becf44de4227d1b7740e915c55de41
SHA256 356fa80cb19c1bb09ae2db4d6950e70f813bf36f097e6f8e8802981d240aa661
SHA512 1a7db7d96e6139d28954e6d53551417df946d4baa6eab73ea708d65e151b93cae2ba32efab3fe6960af2bb9aaa56707b5deac3fc006ac43b3e0128f7208a0448