Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 17:17
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Stealers/Dridex.dll
-
Size
1.2MB
-
MD5
304109f9a5c3726818b4c3668fdb71fd
-
SHA1
2eb804e205d15d314e7f67d503940f69f5dc2ef8
-
SHA256
af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
-
SHA512
cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
-
SSDEEP
24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral22/memory/3532-4-0x0000000002850000-0x0000000002851000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
SystemPropertiesDataExecutionPrevention.exeMoUsoCoreWorker.exeperfmon.exepid process 624 SystemPropertiesDataExecutionPrevention.exe 2004 MoUsoCoreWorker.exe 2044 perfmon.exe -
Loads dropped DLL 3 IoCs
Processes:
SystemPropertiesDataExecutionPrevention.exeMoUsoCoreWorker.exeperfmon.exepid process 624 SystemPropertiesDataExecutionPrevention.exe 2004 MoUsoCoreWorker.exe 2044 perfmon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Iwctvdcrnln = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\CVxo69b3B\\MoUsoCoreWorker.exe" -
Processes:
perfmon.exerundll32.exeSystemPropertiesDataExecutionPrevention.exeMoUsoCoreWorker.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA perfmon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SystemPropertiesDataExecutionPrevention.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MoUsoCoreWorker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 4044 rundll32.exe 4044 rundll32.exe 4044 rundll32.exe 4044 rundll32.exe 4044 rundll32.exe 4044 rundll32.exe 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 3532 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3532 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid process target process PID 3532 wrote to memory of 1488 3532 SystemPropertiesDataExecutionPrevention.exe PID 3532 wrote to memory of 1488 3532 SystemPropertiesDataExecutionPrevention.exe PID 3532 wrote to memory of 624 3532 SystemPropertiesDataExecutionPrevention.exe PID 3532 wrote to memory of 624 3532 SystemPropertiesDataExecutionPrevention.exe PID 3532 wrote to memory of 4556 3532 MoUsoCoreWorker.exe PID 3532 wrote to memory of 4556 3532 MoUsoCoreWorker.exe PID 3532 wrote to memory of 2004 3532 MoUsoCoreWorker.exe PID 3532 wrote to memory of 2004 3532 MoUsoCoreWorker.exe PID 3532 wrote to memory of 636 3532 perfmon.exe PID 3532 wrote to memory of 636 3532 perfmon.exe PID 3532 wrote to memory of 2044 3532 perfmon.exe PID 3532 wrote to memory of 2044 3532 perfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\Trdxzmfuf\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\Trdxzmfuf\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\UutdpO4I\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\UutdpO4I\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\NpORxIYw5\perfmon.exeC:\Users\Admin\AppData\Local\NpORxIYw5\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\NpORxIYw5\credui.dllFilesize
1.2MB
MD5ee6949bde7b37921ffdb5745a5b2f77d
SHA1726018b70977a57480db37966f6469268714260a
SHA2565ba918f95e71a70928b63329fdf4f9df97b9fd8bdb15679f8344faeba097a6c0
SHA512a8486776c956ae00e2580f69619ad34eaf44c8818a2193d76f89c400695016c231130af02fbaf776879d0f8c501ecaca5535c787dae329e7952df99d08f5b050
-
C:\Users\Admin\AppData\Local\NpORxIYw5\perfmon.exeFilesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
C:\Users\Admin\AppData\Local\Trdxzmfuf\SYSDM.CPLFilesize
1.2MB
MD5871f54674a5f184d6819142f096df9a3
SHA1b36af93fb47ae742ca9563b414ceb6e4d54cc60a
SHA2562c3018181ab364f2214385d4047e61474ef815a9019237bca2d5e5500531a7a3
SHA51252a9429270a5dd2f1eb30b8b385e20b85f53701ecc15159311f3867971329fc035d8139c4758423fbc6369af7b943538e7fb116f456982bce7bac489c016c439
-
C:\Users\Admin\AppData\Local\Trdxzmfuf\SystemPropertiesDataExecutionPrevention.exeFilesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
C:\Users\Admin\AppData\Local\UutdpO4I\MoUsoCoreWorker.exeFilesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
C:\Users\Admin\AppData\Local\UutdpO4I\XmlLite.dllFilesize
1.2MB
MD590f1554a5e5cb4bc7c0b67920d773388
SHA1172865fb1752da3d44a062812e7393cebec158a0
SHA256bc368dfcc96d113046dc8b71848b85a74a15477ff1d44717b93fc3224a5519db
SHA51286b7c5d09ba78ff7d65c9e3ab2c27874247bd7191df264e72176aa97a6c72273bcd2c185487d19dacd350462c511400d1d0cb9a7cc119b7d16b0cb3a5a2a0207
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Puokv.lnkFilesize
967B
MD59227ecf3214e09c7e388a43eb02a3c37
SHA108a323871c9b8878bff7b62ce0dd8d67425c9123
SHA256f1ffb184c61dd3323bbbd38a4b8b6e14528b732416a20c52375ae33464fcdc87
SHA5122c935a51f18a931246e30c55260ed6c87c6c7212687647185fa18cf086aee1dd6a7dd8f032f8698913ee70cb1b65e78596134142db4b19e2f309ea3fef677b07
-
memory/624-49-0x00000146DCF50000-0x00000146DCF57000-memory.dmpFilesize
28KB
-
memory/624-46-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/624-52-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/2004-69-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/2004-63-0x00000224002B0000-0x00000224002B7000-memory.dmpFilesize
28KB
-
memory/2044-83-0x00000152EF380000-0x00000152EF387000-memory.dmpFilesize
28KB
-
memory/2044-86-0x0000000140000000-0x0000000140144000-memory.dmpFilesize
1.3MB
-
memory/3532-29-0x00000000008D0000-0x00000000008D7000-memory.dmpFilesize
28KB
-
memory/3532-14-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-7-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-36-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-6-0x00007FF977DFA000-0x00007FF977DFB000-memory.dmpFilesize
4KB
-
memory/3532-9-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-10-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-11-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-13-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-8-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-16-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-4-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/3532-30-0x00007FF978030000-0x00007FF978040000-memory.dmpFilesize
64KB
-
memory/3532-25-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-15-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/3532-12-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/4044-0-0x000001597EC90000-0x000001597EC97000-memory.dmpFilesize
28KB
-
memory/4044-39-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB
-
memory/4044-1-0x0000000140000000-0x0000000140143000-memory.dmpFilesize
1.3MB