Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 16:15
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Stealers/Dridex.dll
-
Size
1.2MB
-
MD5
304109f9a5c3726818b4c3668fdb71fd
-
SHA1
2eb804e205d15d314e7f67d503940f69f5dc2ef8
-
SHA256
af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
-
SHA512
cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
-
SSDEEP
24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral21/memory/1204-5-0x0000000002DC0000-0x0000000002DC1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
msdtc.exetabcal.execmstp.exepid process 2684 msdtc.exe 1624 tabcal.exe 2812 cmstp.exe -
Loads dropped DLL 7 IoCs
Processes:
msdtc.exetabcal.execmstp.exepid process 1204 2684 msdtc.exe 1204 1624 tabcal.exe 1204 2812 cmstp.exe 1204 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gdussggr = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\02\\tabcal.exe" -
Processes:
cmstp.exerundll32.exemsdtc.exetabcal.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmstp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msdtc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tabcal.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 2104 rundll32.exe 2104 rundll32.exe 2104 rundll32.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid process target process PID 1204 wrote to memory of 2772 1204 msdtc.exe PID 1204 wrote to memory of 2772 1204 msdtc.exe PID 1204 wrote to memory of 2772 1204 msdtc.exe PID 1204 wrote to memory of 2684 1204 msdtc.exe PID 1204 wrote to memory of 2684 1204 msdtc.exe PID 1204 wrote to memory of 2684 1204 msdtc.exe PID 1204 wrote to memory of 2156 1204 tabcal.exe PID 1204 wrote to memory of 2156 1204 tabcal.exe PID 1204 wrote to memory of 2156 1204 tabcal.exe PID 1204 wrote to memory of 1624 1204 tabcal.exe PID 1204 wrote to memory of 1624 1204 tabcal.exe PID 1204 wrote to memory of 1624 1204 tabcal.exe PID 1204 wrote to memory of 2588 1204 cmstp.exe PID 1204 wrote to memory of 2588 1204 cmstp.exe PID 1204 wrote to memory of 2588 1204 cmstp.exe PID 1204 wrote to memory of 2812 1204 cmstp.exe PID 1204 wrote to memory of 2812 1204 cmstp.exe PID 1204 wrote to memory of 2812 1204 cmstp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\dRrLi\msdtc.exeC:\Users\Admin\AppData\Local\dRrLi\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\tjTP\tabcal.exeC:\Users\Admin\AppData\Local\tjTP\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\ezOlKqq\cmstp.exeC:\Users\Admin\AppData\Local\ezOlKqq\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\dRrLi\VERSION.dllFilesize
1.2MB
MD52ea3372bf2a59ddf29b2f115052d7788
SHA1cd1af1cfa3bfb813f96bd971d5067f22df6e97eb
SHA25675f10e218a62a7b97e8dfcc3e71c288ba83403623fd6deb13a3a79097ec8ffe7
SHA5123f38d43258314bd8522a67591d684acac1e80b8c542fee4f9806e065ccd8d347d48eecf2900671dae2b1d3b7ce6fa55b48c3e32daf4c13331632c99dfcd3c988
-
C:\Users\Admin\AppData\Local\ezOlKqq\VERSION.dllFilesize
1.2MB
MD5a16fa8833c970132d8ad8aefb37e0c2b
SHA1e39cc03bf504f1d98410fb5d71b62e6d094d98b2
SHA25671262421be65c90a42bfdfbbdf1d6fd03b1a3029cd9605a8dd35a1c2520d8259
SHA51240e714813a81dbfd015da4f94e10017114ed635c346c6836eb38d36728a006d2cf1d0f3a87ba9a4b74c746c754d80ebb8cc151b3933defddfaf1d5df26383f6b
-
C:\Users\Admin\AppData\Local\tjTP\HID.DLLFilesize
1.2MB
MD523215edc3f324842d6b96dd89477c5c1
SHA1d7c5979b76ca68d99df6ae7a3f4f18b68b9c579c
SHA2560d038882c5d1bc39face3b77945eb2cb7e73d5315607aad75f723cc3e90082f8
SHA512cdd739a9e2da2705c40d88f7b786b5b532e02bd8479d393050b67ae8790c804987d932067b67a236795dfa58a8017792652313dc48cf8640cb936319535db109
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Smfbypnq.lnkFilesize
1KB
MD58ac12636146f75dc64d5aa3ecf4ccaed
SHA1d7f9cbb0e94bf47ef4fd19dbf6078514cec46398
SHA2562a5729b9417ad6cfad00544a77e32538f82406ec1c47a65bdf651824fd35d51b
SHA512ea138056e9c6b25904d5e5160436ebde8766c1f802f6cd6066c69069614d76353fd25d62cb6a5d3dd5b599960d9758f90e252cf6372350b6e068501102d2d44f
-
\Users\Admin\AppData\Local\dRrLi\msdtc.exeFilesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
\Users\Admin\AppData\Local\ezOlKqq\cmstp.exeFilesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
\Users\Admin\AppData\Local\tjTP\tabcal.exeFilesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
memory/1204-30-0x0000000077660000-0x0000000077662000-memory.dmpFilesize
8KB
-
memory/1204-11-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-15-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-14-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-13-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-12-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-10-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-9-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-26-0x0000000002DA0000-0x0000000002DA7000-memory.dmpFilesize
28KB
-
memory/1204-4-0x00000000772C6000-0x00000000772C7000-memory.dmpFilesize
4KB
-
memory/1204-29-0x00000000774D1000-0x00000000774D2000-memory.dmpFilesize
4KB
-
memory/1204-39-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-37-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-5-0x0000000002DC0000-0x0000000002DC1000-memory.dmpFilesize
4KB
-
memory/1204-16-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-8-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-75-0x00000000772C6000-0x00000000772C7000-memory.dmpFilesize
4KB
-
memory/1204-7-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1204-25-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/1624-76-0x00000000000A0000-0x00000000000A7000-memory.dmpFilesize
28KB
-
memory/1624-79-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/2104-46-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/2104-0-0x00000000001A0000-0x00000000001A7000-memory.dmpFilesize
28KB
-
memory/2104-1-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/2684-60-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/2684-55-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/2684-54-0x0000000000190000-0x0000000000197000-memory.dmpFilesize
28KB
-
memory/2812-96-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB