Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-02-2024 11:03

General

  • Target

    8958de5c2bf9701d5a7d93d25444c447.dll

  • Size

    1.7MB

  • MD5

    8958de5c2bf9701d5a7d93d25444c447

  • SHA1

    a7ce13895a1f347b2efb1b028041e78376a8193d

  • SHA256

    f07f4994e0fb57cc2f550e7cc7059b2eb27470c13df7ff76e488626d7e8c5efb

  • SHA512

    5dee19a23e54b34acd0a7eca69ebdac3f9c5c0b124d07640a075013f3610263172a7ea804bb1176294e4e800ce2d16e5670fec4455fef21a67c68f8f0183fbbf

  • SSDEEP

    12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8958de5c2bf9701d5a7d93d25444c447.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2508
  • C:\Windows\system32\Netplwiz.exe
    C:\Windows\system32\Netplwiz.exe
    1⤵
      PID:3760
    • C:\Users\Admin\AppData\Local\8Vpo4\Netplwiz.exe
      C:\Users\Admin\AppData\Local\8Vpo4\Netplwiz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:736
    • C:\Windows\system32\SysResetErr.exe
      C:\Windows\system32\SysResetErr.exe
      1⤵
        PID:548
      • C:\Users\Admin\AppData\Local\Uv0DTXN\Netplwiz.exe
        C:\Users\Admin\AppData\Local\Uv0DTXN\Netplwiz.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2208
      • C:\Windows\system32\Netplwiz.exe
        C:\Windows\system32\Netplwiz.exe
        1⤵
          PID:1600
        • C:\Users\Admin\AppData\Local\bDWwEIYm\SysResetErr.exe
          C:\Users\Admin\AppData\Local\bDWwEIYm\SysResetErr.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3020

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\8Vpo4\NETPLWIZ.dll

          Filesize

          228KB

          MD5

          aed00e8471456737c620d2f80839b93c

          SHA1

          d27b1d890abd587bd4866832775a555951fb4542

          SHA256

          119ab458476a0fe6e6a518c06b963d75c95502ee11d38e12fa8fe1db65a18d5b

          SHA512

          a7a59e118acd8f7e906551dd399137d77f3959408ac3a419e404943e6be0ec9965eafc363373c45503dd80f7233b8b59d793b0c83d5b3431f45e6076d5e87ad1

        • C:\Users\Admin\AppData\Local\8Vpo4\NETPLWIZ.dll

          Filesize

          302KB

          MD5

          62c3d0c77bf5179d3c31758823d7b052

          SHA1

          f68f389c94604f5928aa88ec4df7b6ac03669935

          SHA256

          00539bd73b878507a79f4fc0baa1ba7a5a33ec3e3c2243d08028499beece873e

          SHA512

          e045af7316c3023edd32cc41951fffd9e6c272a0d93c571a0fb55f11cab596559688dab945d66433dc3f33da37d66cc386d79eba768a6beda098d8b498b2e0fb

        • C:\Users\Admin\AppData\Local\8Vpo4\Netplwiz.exe

          Filesize

          40KB

          MD5

          520a7b7065dcb406d7eca847b81fd4ec

          SHA1

          d1b3b046a456630f65d482ff856c71dfd2f335c8

          SHA256

          8323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d

          SHA512

          7aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914

        • C:\Users\Admin\AppData\Local\8Vpo4\Netplwiz.exe

          Filesize

          9KB

          MD5

          557f87abe6078231780f728adfa930b1

          SHA1

          9c55be79aba51648568540bea4b351bbc8b5f9ca

          SHA256

          982351cf4f7064f361b46b063de1cec3d16518a11b89aa737132ee19c4d61e3e

          SHA512

          c1c3e0ba3b771937edb1d7543c8cab63dd1b62d3366c90ea85f84d3e27fc85fba4dcde4996a45217563aa197a65544b63f7744d694f56ca9fb55243ff144cb78

        • C:\Users\Admin\AppData\Local\Uv0DTXN\NETPLWIZ.dll

          Filesize

          105KB

          MD5

          1ed82a44ce8ec81aa18e4fb8b1680715

          SHA1

          e0270267e49c5b76f08bb86acfcad6e5442f816a

          SHA256

          6c815c7f2506069748b73e97a5a5a4a3342df97aa97aaba335656bb5e93aa5cf

          SHA512

          21cf0388ecd3cb897721aac35eada417e9a4ccccd3be2d70704e1c07c46ef45ccbffb6a5663d24e1ef774e7da6878d01abd0689dd9c62c9b115d1aba9706ff49

        • C:\Users\Admin\AppData\Local\Uv0DTXN\NETPLWIZ.dll

          Filesize

          140KB

          MD5

          dfe8901172a1c4ab473b2eab3ef45500

          SHA1

          e5e36692328506298b896e012d8de46d679d2012

          SHA256

          6371c0fc50a80b872247c81be13cc05d1e9f33de9e8024e06623e1f85641dada

          SHA512

          2464298d9447d6319b0f24b033b6d6b2d31e6d21d48f2b68efe5748eb1cef53b41b6494b01132b702eea478416a5b44737ae79bca06946b7dd2141838cd52ae3

        • C:\Users\Admin\AppData\Local\bDWwEIYm\DUI70.dll

          Filesize

          113KB

          MD5

          9d817a5feabe94dd9780283cca3330ba

          SHA1

          3d33590d509c6beabf469d98bd4c37cbfd08da46

          SHA256

          b796fe31ecfaa2e0f577d62ada7cd8bf011d4f1e539effbb6bbb697c98f9ae1b

          SHA512

          31af88a03e9fd72efd49030e3752a2114e3ccc3915e4733b7521918ae9c219a6eb34c763ea460b2ecbf77309f516afd839a7bae117acb903886be4ae84e9ef4d

        • C:\Users\Admin\AppData\Local\bDWwEIYm\DUI70.dll

          Filesize

          169KB

          MD5

          a85872effffd98b9f9011dde07335f0b

          SHA1

          b085261a5ebbb713db282f3ca6a1db28215e2c5d

          SHA256

          b54205a209de778cb852be731224f0aae7d0ab2b8f4093bdc094076f50324dd9

          SHA512

          23c40403e732ad98cf850814597a9774d7bcb0f504cc49fb835e841898d7b87157b509c773a24bf76d816a3138c9f3f7b9b9f69ce643efe09c7f092fa06083a2

        • C:\Users\Admin\AppData\Local\bDWwEIYm\SysResetErr.exe

          Filesize

          41KB

          MD5

          090c6f458d61b7ddbdcfa54e761b8b57

          SHA1

          c5a93e9d6eca4c3842156cc0262933b334113864

          SHA256

          a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd

          SHA512

          c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mkzwiunlad.lnk

          Filesize

          1KB

          MD5

          80aa05f1524fa83cb51dfc3dbce96d1e

          SHA1

          52c135b44a2a4222ef2d100b70a115f89456aeb3

          SHA256

          583283f161c2a184815edfda3b825d682d6e37629fe1e71c32f4f7493d0e00e4

          SHA512

          3d71175a2e628662c97181faca41550d952b04a94e535f62e947330dede413a6b1831d72c4dcdebf5b64b99997bbf9ce5c110e9a7bbdc67ab5e25488747b03f9

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\4GUS\DUI70.dll

          Filesize

          999KB

          MD5

          427ef53bb09581f767c697c3147f7e2c

          SHA1

          43ad8b1f2213b166e508376e4f96fe8d155c4766

          SHA256

          46482d08805a889da37c3fe7e8c07f564613555a95a67b2294b7620cb4a17d08

          SHA512

          3313d5c7954c470255d0764f5b02e35a29c30e8cc7394b49cd098967faf18c4054239fdeae8aa7ad203ee87d278d37f05164e37d5b7ec89d1257010bbec0bcb1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Proof\KOn\NETPLWIZ.dll

          Filesize

          425KB

          MD5

          f81a683aec0a74626f8945043acd965d

          SHA1

          104400609b2024a9e9dee795bd1d3cb0b78db4ea

          SHA256

          c7c456481ed06c4578b462dee6e2277a8b6e09edc4fe7e17499c15ee2a042d92

          SHA512

          916cef5a0bf730a56df2e168a3aafc8171f4fadf0b75a66b2f0391d3296a99aa8458554d3db64abf3ba1cc7dca587b79329a6888c41091e27a340c0ae22b5efd

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\tDNPr89K6bi\NETPLWIZ.dll

          Filesize

          376KB

          MD5

          27d34f39b88d5f2895983de165c72f5a

          SHA1

          0f5e1b131b69c0c90c6a6ee77483c4d9c8538362

          SHA256

          32fb0c879820b5acc5361a2ae6d436bb9fd1f39b3691ddcf858dc0518924d62d

          SHA512

          d48eafeba2200955bf3d6e705adb39d738c1a62a6cf3ec34531179cd5429bdd8278b9c76de5cdf88d9837b7b70ae14714f960acfba66b41e7dc839728a1edd84

        • memory/736-64-0x0000000140000000-0x00000001401AF000-memory.dmp

          Filesize

          1.7MB

        • memory/736-70-0x0000000140000000-0x00000001401AF000-memory.dmp

          Filesize

          1.7MB

        • memory/736-66-0x00000169CCD10000-0x00000169CCD17000-memory.dmp

          Filesize

          28KB

        • memory/2208-98-0x0000015E51550000-0x0000015E51557000-memory.dmp

          Filesize

          28KB

        • memory/2208-104-0x0000000140000000-0x00000001401AF000-memory.dmp

          Filesize

          1.7MB

        • memory/2508-2-0x0000011ABE280000-0x0000011ABE287000-memory.dmp

          Filesize

          28KB

        • memory/2508-0-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/2508-7-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3020-81-0x0000000140000000-0x00000001401F4000-memory.dmp

          Filesize

          2.0MB

        • memory/3020-87-0x0000000140000000-0x00000001401F4000-memory.dmp

          Filesize

          2.0MB

        • memory/3020-83-0x00000270F0030000-0x00000270F0037000-memory.dmp

          Filesize

          28KB

        • memory/3496-19-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-29-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-23-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-22-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-34-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-33-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-35-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-36-0x0000000001220000-0x0000000001227000-memory.dmp

          Filesize

          28KB

        • memory/3496-32-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-31-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-43-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-53-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-55-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-44-0x00007FFBCC620000-0x00007FFBCC630000-memory.dmp

          Filesize

          64KB

        • memory/3496-26-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-28-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-30-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-25-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-27-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-24-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-4-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

          Filesize

          4KB

        • memory/3496-21-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-17-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-20-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-18-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-16-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-14-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-15-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-13-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-12-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-11-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-10-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-8-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB

        • memory/3496-9-0x00007FFBCA79A000-0x00007FFBCA79B000-memory.dmp

          Filesize

          4KB

        • memory/3496-6-0x0000000140000000-0x00000001401AE000-memory.dmp

          Filesize

          1.7MB