Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

  • max time kernel
    68s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 18:57

Errors

Reason
Machine shutdown

General

  • Target

    Stealers/Dridex.dll

  • Size

    1.2MB

  • MD5

    304109f9a5c3726818b4c3668fdb71fd

  • SHA1

    2eb804e205d15d314e7f67d503940f69f5dc2ef8

  • SHA256

    af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d

  • SHA512

    cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01

  • SSDEEP

    24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1364
  • C:\Windows\system32\cttune.exe
    C:\Windows\system32\cttune.exe
    1⤵
      PID:4596
    • C:\Users\Admin\AppData\Local\phIjo7gn\cttune.exe
      C:\Users\Admin\AppData\Local\phIjo7gn\cttune.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2644
    • C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
      C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
      1⤵
        PID:1360
      • C:\Users\Admin\AppData\Local\kiMf\PasswordOnWakeSettingFlyout.exe
        C:\Users\Admin\AppData\Local\kiMf\PasswordOnWakeSettingFlyout.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4912
      • C:\Windows\system32\Taskmgr.exe
        C:\Windows\system32\Taskmgr.exe
        1⤵
          PID:2952
        • C:\Users\Admin\AppData\Local\aVB29uSL\Taskmgr.exe
          C:\Users\Admin\AppData\Local\aVB29uSL\Taskmgr.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:400
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa3948055 /state1:0x41c64e6d
          1⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:1620

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\aVB29uSL\Taskmgr.exe

          Filesize

          1.2MB

          MD5

          58d5bc7895f7f32ee308e34f06f25dd5

          SHA1

          7a7f5e991ddeaf73e15a0fdcb5c999c0248a2fa4

          SHA256

          4e305198f15bafd5728b5fb8e7ff48d9f312399c744ecfea0ecac79d93c5e478

          SHA512

          872c84c92b0e4050ae4a4137330ec3cda30008fd15d6413bf7a913c03a021ad41b6131e5a7356b374ced98d37ae207147ebefd93893560dc15c3e9875f93f7a9

        • C:\Users\Admin\AppData\Local\aVB29uSL\dxgi.dll

          Filesize

          1.2MB

          MD5

          8fc8499034407a2550ace06c082a72ae

          SHA1

          5e87b875a59d7d8828fdbe72f6ba03a5c8fcd4d2

          SHA256

          228f5d055a722040b8f6a5b27a9b0bfc148375af6cf4c081061f89339742913e

          SHA512

          0228f66312ba0dd0c0e19ea0a22d8e06f0efccc42b2d351fff69f9a478d2889e455b812740d1dc16a664cf9d7197262c1f9296d4e4b1ed187c18a5b816683838

        • C:\Users\Admin\AppData\Local\kiMf\DUI70.dll

          Filesize

          1.5MB

          MD5

          69e64fc49ec0e9862e178a4a3bc7e6e1

          SHA1

          ab97263582574891a011151e7b9c8c50c9c7b4f9

          SHA256

          0d5bab872aa6912c2c1c28a594728116b64165481f15ff0d4b1833a08aba323e

          SHA512

          0179b02bb62c6126c45812d8b52fa728402cb3a4d1c5a618516b5347c0892bf88aa86730be7e8ab705b155a7c381e64f31f89b62b110e4e8353a67265e257660

        • C:\Users\Admin\AppData\Local\kiMf\PasswordOnWakeSettingFlyout.exe

          Filesize

          44KB

          MD5

          591a98c65f624c52882c2b238d6cd4c4

          SHA1

          c960d08c19d777069cf265dcc281807fbd8502d7

          SHA256

          5e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06

          SHA512

          1999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074

        • C:\Users\Admin\AppData\Local\phIjo7gn\OLEACC.dll

          Filesize

          1.2MB

          MD5

          f35c289704fcc07395f72db9551edab2

          SHA1

          c8423c5847ba4a7021e458cb51584223d79cbd45

          SHA256

          0c7b838d466a1b000e7308d8e182b0fe0df589a89f561e6afade2492d50e2f3b

          SHA512

          8c4f8cf84b1f29739c30bce4eff72f90d52e93a00bd28fdccb9189700ff3e9224c565ecd08d18599ffe7ad248dc9b0a0c15078a84b7a6de974224274bcf85983

        • C:\Users\Admin\AppData\Local\phIjo7gn\cttune.exe

          Filesize

          90KB

          MD5

          fa924465a33833f41c1a39f6221ba460

          SHA1

          801d505d81e49d2b4ffa316245ca69ff58c523c3

          SHA256

          de2d871afe2c071cf305fc488875563b778e7279e57030ba1a1c9f7e360748da

          SHA512

          eef91316e1a679cc2183d4fe9f8f40b5efa6d06f7d1246fd399292e14952053309b6891059da88134a184d9bd0298a45a1bf4bc9f27140b1a31b9523acbf3757

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Piobvoh.lnk

          Filesize

          1KB

          MD5

          3117f6250e8bc29b2ffc8dc6e04adf81

          SHA1

          d2a4587ca8d1828b647e3d0b9250185afa19fa12

          SHA256

          7d5e7776f463f165f2064fa833f2862f1fc92490694f78c888d59c65d8262643

          SHA512

          1a6ab01726362f9788f83f70aedfe94a5ad3cab4f8b7288d77180a92008dba9676503469433199e2d8d7ddd23a7ba2745399247c202cd3b249aeba0d152ffa84

        • memory/400-86-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/1364-0-0x000001C158860000-0x000001C158867000-memory.dmp

          Filesize

          28KB

        • memory/1364-39-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/1364-2-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/2644-52-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/2644-47-0x0000000140000000-0x0000000140144000-memory.dmp

          Filesize

          1.3MB

        • memory/2644-46-0x0000024B73050000-0x0000024B73057000-memory.dmp

          Filesize

          28KB

        • memory/3376-25-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-30-0x00007FFA1CA70000-0x00007FFA1CA80000-memory.dmp

          Filesize

          64KB

        • memory/3376-7-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-36-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-15-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-16-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-8-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-10-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-12-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-14-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-29-0x00000000031C0000-0x00000000031C7000-memory.dmp

          Filesize

          28KB

        • memory/3376-9-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-129-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-132-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

          Filesize

          4KB

        • memory/3376-4-0x00000000031E0000-0x00000000031E1000-memory.dmp

          Filesize

          4KB

        • memory/3376-13-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-11-0x0000000140000000-0x0000000140143000-memory.dmp

          Filesize

          1.3MB

        • memory/3376-6-0x00007FFA1C3EA000-0x00007FFA1C3EB000-memory.dmp

          Filesize

          4KB

        • memory/4912-69-0x0000000140000000-0x0000000140189000-memory.dmp

          Filesize

          1.5MB

        • memory/4912-64-0x0000000140000000-0x0000000140189000-memory.dmp

          Filesize

          1.5MB

        • memory/4912-63-0x000001F10A8F0000-0x000001F10A8F7000-memory.dmp

          Filesize

          28KB