Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2024, 19:49

General

  • Target

    e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll

  • Size

    800KB

  • MD5

    252395046102ed9612e50d71bdc56fe5

  • SHA1

    23b893ede7e9473b4fdae8051d935ca08593c958

  • SHA256

    e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66

  • SHA512

    a5cde48eff1e96551d66cae42d8cc88c58efd71bf3ce9da18bdd77c82b285d643c11ffbe55631d22c6e9ecaaa0c45053d74ba46254766c983563704d5d4ba12e

  • SSDEEP

    12288:zBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:t/nts0Q9K/0ooRQIxAk2wi0N/

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 11 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4488
  • C:\Windows\system32\dpapimig.exe
    C:\Windows\system32\dpapimig.exe
    1⤵
      PID:2504
    • C:\Users\Admin\AppData\Local\66RbyD\dpapimig.exe
      C:\Users\Admin\AppData\Local\66RbyD\dpapimig.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:4392
    • C:\Windows\system32\MoUsoCoreWorker.exe
      C:\Windows\system32\MoUsoCoreWorker.exe
      1⤵
        PID:2644
      • C:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exe
        C:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3056
      • C:\Windows\system32\rdpshell.exe
        C:\Windows\system32\rdpshell.exe
        1⤵
          PID:4376
        • C:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exe
          C:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2392

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\66RbyD\DUI70.dll

          Filesize

          1.1MB

          MD5

          dce004fa7f5c7165f9e31d4637e4604b

          SHA1

          a09035d0d3148112fdaf0fd7f3b9b7832abe3c86

          SHA256

          d545e8d81b4161f91b01cfcdfced0de65bc7b64529aa542639f979e1fec89e14

          SHA512

          c73fa228c2a58df50d85242db2c1df9c690eda65855e2e52138f1e0bf2910d9291b8016e71847ab4be84fa76f547bfb89f0588b24a2d70c7791b8c6ee72c8ea7

        • C:\Users\Admin\AppData\Local\66RbyD\dpapimig.exe

          Filesize

          76KB

          MD5

          b6d6477a0c90a81624c6a8548026b4d0

          SHA1

          e6eac6941d27f76bbd306c2938c0a962dbf1ced1

          SHA256

          a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb

          SHA512

          72ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe

        • C:\Users\Admin\AppData\Local\MnGptzjL9\WINSTA.dll

          Filesize

          808KB

          MD5

          9f8da0ac7743b2ac9edcaebcbe6d3397

          SHA1

          8fe5f6297274ff05c59ed33170142886d1cd6471

          SHA256

          e22154610c677af11743c61fd5e2e8bebb1f4dbd2a0e3ce7d8536b665427b2d2

          SHA512

          86fcedb3675e10de00678868b2db91a3e5092a5119d7d75be882c832e6f2c727a2beab791454f99af3cbfa89fcbd2390c7fb347ed0fd4b264aee940f41e0e186

        • C:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exe

          Filesize

          468KB

          MD5

          428066713f225bb8431340fa670671d4

          SHA1

          47f6878ff33317c3fc09c494df729a463bda174c

          SHA256

          da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd

          SHA512

          292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737

        • C:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exe

          Filesize

          1.6MB

          MD5

          47c6b45ff22b73caf40bb29392386ce3

          SHA1

          7e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9

          SHA256

          cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0

          SHA512

          c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331

        • C:\Users\Admin\AppData\Local\W3yRC\XmlLite.dll

          Filesize

          804KB

          MD5

          e8d434bd58232c8cb33bba1771b0f900

          SHA1

          7a95a775c3662f69fc095f658fc80625de1804c3

          SHA256

          02246dc3449851a9c7ed7a1e051b897415864759bd5cde6664521d0af8076195

          SHA512

          2732cc0e7d1a1870d99d3f3eaa31f62afa3b25fde06e249380b37b6ff6fd6e687530193e8a7bb0a963b4da6a3ba9078430583ef5a0637ff2d65af795bc0efbe2

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Igacdkfje.lnk

          Filesize

          981B

          MD5

          c52be938f70b326b907a81161c3b5f53

          SHA1

          4601265cb02a1f7b05a329f26518b6031e1dbf24

          SHA256

          380fa57aa6cab1882c13fc44280535b51a89d334d3f377696816555bffa764a2

          SHA512

          fe1ff6573510afa31c47be9ef8f631bd52038208fa929cf648bd3eb27744fad76bd0afdec3c41f549fac89a30ae332766a4eaee32d4497dfc00c2450ec7ba2bc

        • memory/2392-96-0x00007FFAED950000-0x00007FFAEDA1A000-memory.dmp

          Filesize

          808KB

        • memory/2392-93-0x00007FFAED950000-0x00007FFAEDA1A000-memory.dmp

          Filesize

          808KB

        • memory/3056-81-0x00007FFAED950000-0x00007FFAEDA19000-memory.dmp

          Filesize

          804KB

        • memory/3056-78-0x0000022226590000-0x0000022226597000-memory.dmp

          Filesize

          28KB

        • memory/3056-76-0x00007FFAED950000-0x00007FFAEDA19000-memory.dmp

          Filesize

          804KB

        • memory/3356-14-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-7-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-26-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-25-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-24-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-23-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-22-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-19-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-20-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-18-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-16-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-15-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-5-0x00007FFB09D2A000-0x00007FFB09D2B000-memory.dmp

          Filesize

          4KB

        • memory/3356-13-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-12-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-11-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-10-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-9-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-8-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-27-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-21-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-3-0x00000000007C0000-0x00000000007C1000-memory.dmp

          Filesize

          4KB

        • memory/3356-28-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-37-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-6-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-17-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-29-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-38-0x00007FFB0AEE0000-0x00007FFB0AEF0000-memory.dmp

          Filesize

          64KB

        • memory/3356-48-0x0000000140000000-0x00000001400C8000-memory.dmp

          Filesize

          800KB

        • memory/3356-39-0x00007FFB0AED0000-0x00007FFB0AEE0000-memory.dmp

          Filesize

          64KB

        • memory/3356-36-0x0000000000650000-0x0000000000657000-memory.dmp

          Filesize

          28KB

        • memory/4392-63-0x00007FFAED910000-0x00007FFAEDA1E000-memory.dmp

          Filesize

          1.1MB

        • memory/4392-60-0x000001AAE31E0000-0x000001AAE31E7000-memory.dmp

          Filesize

          28KB

        • memory/4392-58-0x00007FFAED910000-0x00007FFAEDA1E000-memory.dmp

          Filesize

          1.1MB

        • memory/4488-51-0x00007FFAFC760000-0x00007FFAFC828000-memory.dmp

          Filesize

          800KB

        • memory/4488-0-0x00007FFAFC760000-0x00007FFAFC828000-memory.dmp

          Filesize

          800KB

        • memory/4488-2-0x00000202B46C0000-0x00000202B46C7000-memory.dmp

          Filesize

          28KB