Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-09-2024 18:12

General

  • Target

    Stealers/Dridex.dll

  • Size

    1.2MB

  • MD5

    304109f9a5c3726818b4c3668fdb71fd

  • SHA1

    2eb804e205d15d314e7f67d503940f69f5dc2ef8

  • SHA256

    af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d

  • SHA512

    cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01

  • SSDEEP

    24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2196
  • C:\Windows\system32\BitLockerWizard.exe
    C:\Windows\system32\BitLockerWizard.exe
    1⤵
      PID:1652
    • C:\Users\Admin\AppData\Local\BigD\BitLockerWizard.exe
      C:\Users\Admin\AppData\Local\BigD\BitLockerWizard.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3036
    • C:\Windows\system32\irftp.exe
      C:\Windows\system32\irftp.exe
      1⤵
        PID:336
      • C:\Users\Admin\AppData\Local\fjTMt\irftp.exe
        C:\Users\Admin\AppData\Local\fjTMt\irftp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1600
      • C:\Windows\system32\SystemPropertiesProtection.exe
        C:\Windows\system32\SystemPropertiesProtection.exe
        1⤵
          PID:2940
        • C:\Users\Admin\AppData\Local\tGET\SystemPropertiesProtection.exe
          C:\Users\Admin\AppData\Local\tGET\SystemPropertiesProtection.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2896

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\BigD\BitLockerWizard.exe

          Filesize

          98KB

          MD5

          08a761595ad21d152db2417d6fdb239a

          SHA1

          d84c1bc2e8c9afce9fb79916df9bca169f93a936

          SHA256

          ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620

          SHA512

          8b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9

        • C:\Users\Admin\AppData\Local\fjTMt\WINMM.dll

          Filesize

          1.2MB

          MD5

          ae35d6cbe83414c42435de962b00dc4c

          SHA1

          8f86c5bec6f652bd5e03ce124a0663736649e1a8

          SHA256

          9b3f8e46b9191140bc3f866d0b282b37398aa72fbb8355a72f1569b2f1c54042

          SHA512

          93c4c55e7ce1478d73d26ece2d505c715a1224dae96fca52148b4dcde10aaebaea6a9c161b94a7d737edc96bb6132dec808c0ca5fbb5b94b1ee41cd36e00f92c

        • C:\Users\Admin\AppData\Local\fjTMt\irftp.exe

          Filesize

          192KB

          MD5

          0cae1fb725c56d260bfd6feba7ae9a75

          SHA1

          102ac676a1de3ec3d56401f8efd518c31c8b0b80

          SHA256

          312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

          SHA512

          db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

        • C:\Users\Admin\AppData\Local\tGET\SystemPropertiesProtection.exe

          Filesize

          80KB

          MD5

          05138d8f952d3fff1362f7c50158bc38

          SHA1

          780bc59fcddf06a7494d09771b8340acffdcc720

          SHA256

          753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd

          SHA512

          27fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

          Filesize

          1KB

          MD5

          18cd5c56ccea18752c9bdab181422727

          SHA1

          6146cbef215335a0a845827ccb8360638989ed12

          SHA256

          3b7054340f55c2759a389c134d5d3a75ac0df2fa84b1e0a1747f15475e90c4c4

          SHA512

          8235439b683639784eb27eeb7381cfe10fc576c89d63e66fc195071306dba6d41c7dae87fa8cb43391a2a0ebe1db98265951317c9156e4d214e97db90d1ba891

        • \Users\Admin\AppData\Local\BigD\FVEWIZ.dll

          Filesize

          1.2MB

          MD5

          6971260254b854f5e8531d01606fbe9b

          SHA1

          fb7cafb667a2262e053b511e536980bd14714939

          SHA256

          f9dea9f1dbff09d103ddd470c9c198710a9f4dad0935e969451667041f4eafbf

          SHA512

          b81da80c907442199324f186be46bbf4f3bc195a17413ff9ea150e49f47ec9eeddcb688ff2cdd78c6721fca1c392c99e256e4028d06add94bcf5248898ed1f1e

        • \Users\Admin\AppData\Local\tGET\SYSDM.CPL

          Filesize

          1.2MB

          MD5

          940f9a3f3f3761e06bcdc6168320b579

          SHA1

          6351ac00614b6d64680d5874b1e2699092ffc99c

          SHA256

          b362bb2f6c7af3ddb48febdab59b2569b56c0e7661fe800cd5aba6b6d6cd0491

          SHA512

          df56d8759010aa1eafc701f137cbff533bcb912f9608fefdb2c3cdade5a418e4abc1db2f7bc0258d577e624be6fb254942738095acbc86e736c755f95c8d767a

        • memory/1160-11-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-28-0x0000000077680000-0x0000000077682000-memory.dmp

          Filesize

          8KB

        • memory/1160-4-0x00000000772E6000-0x00000000772E7000-memory.dmp

          Filesize

          4KB

        • memory/1160-10-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-9-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-8-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-7-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-16-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-26-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-17-0x0000000002540000-0x0000000002547000-memory.dmp

          Filesize

          28KB

        • memory/1160-27-0x00000000774F1000-0x00000000774F2000-memory.dmp

          Filesize

          4KB

        • memory/1160-37-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-39-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-5-0x0000000002D10000-0x0000000002D11000-memory.dmp

          Filesize

          4KB

        • memory/1160-47-0x00000000772E6000-0x00000000772E7000-memory.dmp

          Filesize

          4KB

        • memory/1160-15-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-12-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-14-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1160-13-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1600-77-0x0000000140000000-0x0000000140145000-memory.dmp

          Filesize

          1.3MB

        • memory/1600-73-0x0000000140000000-0x0000000140145000-memory.dmp

          Filesize

          1.3MB

        • memory/1600-72-0x0000000000130000-0x0000000000137000-memory.dmp

          Filesize

          28KB

        • memory/2196-46-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/2196-2-0x00000000003A0000-0x00000000003A7000-memory.dmp

          Filesize

          28KB

        • memory/2196-0-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/2896-94-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/3036-56-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/3036-60-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/3036-55-0x0000000000290000-0x0000000000297000-memory.dmp

          Filesize

          28KB