Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 16:15

General

  • Target

    6603627b822e6cddf2cb9cd264d26ebc46790f4ca90c6806e06a4b3c1be6a14d.dll

  • Size

    688KB

  • MD5

    551c56a5dd44632dba1058d26deb2fce

  • SHA1

    f160c54abfeb843c44d85abd9d7eb88519d1c104

  • SHA256

    6603627b822e6cddf2cb9cd264d26ebc46790f4ca90c6806e06a4b3c1be6a14d

  • SHA512

    c72c753caf8cd7f1c9be2cd4776be3175704acbdecb0494cd9734d84fab04f12a1d419954ac1ba985b03ba863a7a946c94b5bfe572eef8c4134e0221f3499160

  • SSDEEP

    12288:bfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:zdAE81W381Wk8jnYz3dsPEb4s

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 10 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6603627b822e6cddf2cb9cd264d26ebc46790f4ca90c6806e06a4b3c1be6a14d.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:844
  • C:\Windows\system32\xpsrchvw.exe
    C:\Windows\system32\xpsrchvw.exe
    1⤵
      PID:2612
    • C:\Users\Admin\AppData\Local\j6uX\xpsrchvw.exe
      C:\Users\Admin\AppData\Local\j6uX\xpsrchvw.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1620
    • C:\Windows\system32\wusa.exe
      C:\Windows\system32\wusa.exe
      1⤵
        PID:3008
      • C:\Users\Admin\AppData\Local\k8o\wusa.exe
        C:\Users\Admin\AppData\Local\k8o\wusa.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2988
      • C:\Windows\system32\calc.exe
        C:\Windows\system32\calc.exe
        1⤵
          PID:1776
        • C:\Users\Admin\AppData\Local\J6B3YQ\calc.exe
          C:\Users\Admin\AppData\Local\J6B3YQ\calc.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1992

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\J6B3YQ\VERSION.dll

          Filesize

          692KB

          MD5

          9eaf86c0dec656df8c14d98f4f2f2f50

          SHA1

          c0478db39260084613e35b3a9e854446eec34881

          SHA256

          f2354811ac75eaf9c1414288b9dcdc89dabf766a94e50b8605190a85a9636729

          SHA512

          3bbc21d27313ff4b801190dca360d37bdf2b418a4acdd701ff5512d53c5c51a8c14c0f92880394ccaddc65b460ade3f7888c733e45c1ed80e6f5914f8ccc9553

        • C:\Users\Admin\AppData\Local\j6uX\WINMM.dll

          Filesize

          696KB

          MD5

          aa70312844147c5ef3426f8d6dfbc051

          SHA1

          c696e5f1b7bed4bcf9acc61acad7ebd45411e433

          SHA256

          66d4bc1deaf277c473ba2d70a7c8d220c0ecb557c3b25cd8f23836f418511606

          SHA512

          f80cf74c4f71dacdaa786f4ccdfa13037432532993cca974d6bc58f7aed62cf9ed8b784f6149601b951075c39b4cf75632523b8eb2ce9ecbd9f537d48ea11400

        • C:\Users\Admin\AppData\Local\k8o\dpx.dll

          Filesize

          692KB

          MD5

          fd7b88df3a19258cb026e0e239b201fa

          SHA1

          31edb56608a17f6235bca3be21e64466bc182de9

          SHA256

          c49e4d63a5179e9a71b80bdf0aeded47436d4c1b3a14de0d1f8d1ae2a6a36c52

          SHA512

          fe0eaa3d77b78d668ee11101726c38d2b1ca07cacda9d470c64daac2e99c779c2bf4cdc58deef8711c63e0e55a6aacb25f65dde87c0018ca1c03a6ae09200179

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

          Filesize

          1KB

          MD5

          2076801c36e72d26372e1b0da3ea11f9

          SHA1

          6e3f7fe43137bb39a4fc28d975668a7ac09cd8ab

          SHA256

          1156c1d72ef14ddf7079c4c547fa191318b352f2e610f434e450fc89b9413b50

          SHA512

          3394251f107e8ae8c143fec1cbdc1b2cb31ef35dc270912774233fa97e79bda76d53d1a37f6cc6be64ebaa224ece3948ef13e505edf7f5d5dc8064ac8b77abbf

        • \Users\Admin\AppData\Local\J6B3YQ\calc.exe

          Filesize

          897KB

          MD5

          10e4a1d2132ccb5c6759f038cdb6f3c9

          SHA1

          42d36eeb2140441b48287b7cd30b38105986d68f

          SHA256

          c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

          SHA512

          9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

        • \Users\Admin\AppData\Local\j6uX\xpsrchvw.exe

          Filesize

          4.6MB

          MD5

          492cb6a624d5dad73ee0294b5db37dd6

          SHA1

          e74806af04a5147ccabfb5b167eb95a0177c43b3

          SHA256

          ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784

          SHA512

          63bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835

        • \Users\Admin\AppData\Local\k8o\wusa.exe

          Filesize

          300KB

          MD5

          c15b3d813f4382ade98f1892350f21c7

          SHA1

          a45c5abc6751bc8b9041e5e07923fa4fc1b4542b

          SHA256

          8f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3

          SHA512

          6d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c

        • memory/844-0-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/844-2-0x00000000000A0000-0x00000000000A7000-memory.dmp

          Filesize

          28KB

        • memory/844-43-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-24-0x0000000077010000-0x0000000077012000-memory.dmp

          Filesize

          8KB

        • memory/1256-22-0x00000000029A0000-0x00000000029A7000-memory.dmp

          Filesize

          28KB

        • memory/1256-10-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-9-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-23-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-25-0x0000000077040000-0x0000000077042000-memory.dmp

          Filesize

          8KB

        • memory/1256-13-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-34-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-35-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-14-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-44-0x0000000076CA6000-0x0000000076CA7000-memory.dmp

          Filesize

          4KB

        • memory/1256-12-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-11-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-3-0x0000000076CA6000-0x0000000076CA7000-memory.dmp

          Filesize

          4KB

        • memory/1256-4-0x00000000029C0000-0x00000000029C1000-memory.dmp

          Filesize

          4KB

        • memory/1256-8-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-6-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1256-7-0x0000000140000000-0x00000001400AC000-memory.dmp

          Filesize

          688KB

        • memory/1620-56-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

        • memory/1620-54-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

        • memory/1620-52-0x0000000000100000-0x0000000000107000-memory.dmp

          Filesize

          28KB

        • memory/1992-102-0x0000000140000000-0x00000001400AD000-memory.dmp

          Filesize

          692KB

        • memory/2988-82-0x0000000140000000-0x00000001400AD000-memory.dmp

          Filesize

          692KB

        • memory/2988-86-0x0000000140000000-0x00000001400AD000-memory.dmp

          Filesize

          692KB