Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-10-2024 19:42

General

  • Target

    e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0bN.dll

  • Size

    1.3MB

  • MD5

    3caab0352ba2d33f6e283006aa3349a0

  • SHA1

    c88e6d554a0cf2f1f9d05867ff0a7607d683e486

  • SHA256

    e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0b

  • SHA512

    ba8acba77d747dce3128da81e1b68f8352ba15e7b75beeee9e78922c3240acbc9348b1979b0f5ec819200c0d9ccbfbd3100e1a58fe0f1c524c5d5460d762527a

  • SSDEEP

    12288:MdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:+MIJxSDX3bqjhcfHk7MzH6z

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 8 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0bN.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:1812
  • C:\Windows\system32\fvenotify.exe
    C:\Windows\system32\fvenotify.exe
    1⤵
      PID:1996
    • C:\Users\Admin\AppData\Local\j0lPMK\fvenotify.exe
      C:\Users\Admin\AppData\Local\j0lPMK\fvenotify.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      PID:2620
    • C:\Windows\system32\wbengine.exe
      C:\Windows\system32\wbengine.exe
      1⤵
        PID:2872
      • C:\Users\Admin\AppData\Local\jqW\wbengine.exe
        C:\Users\Admin\AppData\Local\jqW\wbengine.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2244
      • C:\Windows\system32\rstrui.exe
        C:\Windows\system32\rstrui.exe
        1⤵
          PID:2448
        • C:\Users\Admin\AppData\Local\pzF\rstrui.exe
          C:\Users\Admin\AppData\Local\pzF\rstrui.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:584

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\j0lPMK\fvenotify.exe

          Filesize

          117KB

          MD5

          e61d644998e07c02f0999388808ac109

          SHA1

          183130ad81ff4c7997582a484e759bf7769592d6

          SHA256

          15a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa

          SHA512

          310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272

        • C:\Users\Admin\AppData\Local\j0lPMK\slc.dll

          Filesize

          1.3MB

          MD5

          9956c4ba7ca067b01fb05aa9f48dcb6a

          SHA1

          3a94097eba8ec755b6031bf5ff0bd7847dfe6e4a

          SHA256

          bd10e938d690de25b1e0b6fe8dddd26c0d6f1e516feabeaf2cb353b89c4aa8a1

          SHA512

          194e7a309957bc97fecb9bf08089abf7356f2250611bc365e922d9994ace219ef829e4aabd7754dc669791266d8f056b86e5cb42c520b9395d871ced51335a61

        • C:\Users\Admin\AppData\Local\jqW\XmlLite.dll

          Filesize

          1.3MB

          MD5

          461ac60485d40d5e261f5851c13f4971

          SHA1

          f475e822244f06258f687122b9308559feb758ce

          SHA256

          ca166a13ea65723e78ec9ccc2700772446a8d5c3af1ac9dbd963a3d75840fa06

          SHA512

          09e60d6a0238bdd457dbf0345e2d881947afa4d2e206fb417d1b90c67d78503f883229358380553c7c1bfa2abac513212948582949f222872f663374b98c1c66

        • C:\Users\Admin\AppData\Local\pzF\SPP.dll

          Filesize

          1.3MB

          MD5

          8556aa917d0cebba4c1f48edffd9deac

          SHA1

          e3c14e90ab375ada5ce4a95055c5bef015a43851

          SHA256

          c4dc3d4cb8412e4b84d474f8a420f2c10559c60264c189e90478db5822ad7515

          SHA512

          0382fdb741828e5983235e85baaca907669f7faa70a5979f88e29bae3fb59f4bb930fe1ce45cef8824ddc2d34972cb0b1fb7104c8b6413a0f1a1b87411a8aa9f

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

          Filesize

          1KB

          MD5

          63b35326f082761c97557b1e545a5a80

          SHA1

          0cd5404dc3e8be5d701b71774f301469080dc14b

          SHA256

          18995aed960f24546535f153c5911339c52219cc7c4ef60e992d70143dfd91c1

          SHA512

          bfb246c1279bf3cc1e19b1d778d011730bcc6932f66182ad2ea84d4b928ada49dc3c159f71e50ff0f2902a0ea09bd8dccafce04990dc7d5ddfdc2b5c4f14de02

        • \Users\Admin\AppData\Local\jqW\wbengine.exe

          Filesize

          1.4MB

          MD5

          78f4e7f5c56cb9716238eb57da4b6a75

          SHA1

          98b0b9db6ec5961dbb274eff433a8bc21f7e557b

          SHA256

          46a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af

          SHA512

          1a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2

        • \Users\Admin\AppData\Local\pzF\rstrui.exe

          Filesize

          290KB

          MD5

          3db5a1eace7f3049ecc49fa64461e254

          SHA1

          7dc64e4f75741b93804cbae365e10dc70592c6a9

          SHA256

          ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49

          SHA512

          ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025

        • memory/584-104-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/1200-20-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-16-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-46-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-45-0x00000000024B0000-0x00000000024B7000-memory.dmp

          Filesize

          28KB

        • memory/1200-37-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-36-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-35-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-34-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-33-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-32-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-31-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-29-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-28-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-27-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-26-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-25-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-24-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-23-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-22-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-21-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-3-0x0000000077926000-0x0000000077927000-memory.dmp

          Filesize

          4KB

        • memory/1200-19-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-17-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-47-0x0000000077B90000-0x0000000077B92000-memory.dmp

          Filesize

          8KB

        • memory/1200-15-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-14-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-13-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-12-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-9-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-8-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-56-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-54-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-63-0x0000000077926000-0x0000000077927000-memory.dmp

          Filesize

          4KB

        • memory/1200-48-0x0000000077BC0000-0x0000000077BC2000-memory.dmp

          Filesize

          8KB

        • memory/1200-30-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-4-0x00000000024A0000-0x00000000024A1000-memory.dmp

          Filesize

          4KB

        • memory/1200-6-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-7-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-11-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-10-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1200-18-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1812-51-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/1812-2-0x0000000000420000-0x0000000000427000-memory.dmp

          Filesize

          28KB

        • memory/1812-0-0x0000000140000000-0x0000000140158000-memory.dmp

          Filesize

          1.3MB

        • memory/2244-92-0x0000000140000000-0x0000000140159000-memory.dmp

          Filesize

          1.3MB

        • memory/2620-76-0x0000000140000000-0x0000000140159000-memory.dmp

          Filesize

          1.3MB

        • memory/2620-71-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/2620-72-0x0000000140000000-0x0000000140159000-memory.dmp

          Filesize

          1.3MB