Analysis

  • max time kernel
    119s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2025 18:05

General

  • Target

    fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843aN.dll

  • Size

    804KB

  • MD5

    0f413d5ba9a89182b758896df48db410

  • SHA1

    7a1fbfde26fd73a4d27a71bd4300392c3b2dadf7

  • SHA256

    fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843a

  • SHA512

    1a083ad20a5def7fef52dba3327e968aa288105b1820c5639d80b488d38e50e0c0005f085233d70f22600e3cda8079e60db4f5b541f28636686505d47bf6126f

  • SSDEEP

    12288:YbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQeB:Ybe42XV7KWgmjDR/T4a/Mdjmv

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843aN.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2644
  • C:\Windows\system32\quickassist.exe
    C:\Windows\system32\quickassist.exe
    1⤵
      PID:1920
    • C:\Users\Admin\AppData\Local\I50eLE\quickassist.exe
      C:\Users\Admin\AppData\Local\I50eLE\quickassist.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3228
    • C:\Windows\system32\SystemPropertiesAdvanced.exe
      C:\Windows\system32\SystemPropertiesAdvanced.exe
      1⤵
        PID:3924
      • C:\Users\Admin\AppData\Local\YFq\SystemPropertiesAdvanced.exe
        C:\Users\Admin\AppData\Local\YFq\SystemPropertiesAdvanced.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:5004
      • C:\Windows\system32\psr.exe
        C:\Windows\system32\psr.exe
        1⤵
          PID:5020
        • C:\Users\Admin\AppData\Local\alFD2Y78\psr.exe
          C:\Users\Admin\AppData\Local\alFD2Y78\psr.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2232

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\I50eLE\UxTheme.dll

          Filesize

          808KB

          MD5

          7cbec9566f1b06347338dc81840c8ff8

          SHA1

          b74821b9c304295df7891c0f5e8793e4aacd374e

          SHA256

          73b4a89f3bd727350fdfa1e911bd57036ae0d8305f8285e2a16317b6a1f77d60

          SHA512

          3efb514b9b39b78d58af23edefc4108567d1d0540a550e7463adaee23eba6d1568fd649d3b2fef63027e317d27386df625d579cb7184aabe96f5be751268e1bb

        • C:\Users\Admin\AppData\Local\I50eLE\quickassist.exe

          Filesize

          665KB

          MD5

          d1216f9b9a64fd943539cc2b0ddfa439

          SHA1

          6fad9aeb7780bdfd88a9a5a73b35b3e843605e6c

          SHA256

          c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2

          SHA512

          c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567

        • C:\Users\Admin\AppData\Local\YFq\SYSDM.CPL

          Filesize

          804KB

          MD5

          33e40f513b3955838b89dba82181adc7

          SHA1

          834614f2ded7460564a31fe7182cf5f4c9b0fe51

          SHA256

          94e75f41a9a6ce7fe29d8dfcf3515d593a1e3cc7a7f3c7db3e4abeca1d5dc63e

          SHA512

          3b248a11baf4fa2325857e10a7e17fbd1b08fa4243415e01ce34b23cfc24a97dd6d98ff71021369402464f61356368f36499a63d27b08c5435ab289ca1327e71

        • C:\Users\Admin\AppData\Local\YFq\SystemPropertiesAdvanced.exe

          Filesize

          82KB

          MD5

          fa040b18d2d2061ab38cf4e52e753854

          SHA1

          b1b37124e9afd6c860189ce4d49cebbb2e4c57bc

          SHA256

          c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c

          SHA512

          511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4

        • C:\Users\Admin\AppData\Local\alFD2Y78\VERSION.dll

          Filesize

          804KB

          MD5

          073a1eba7634b3c68cf3ffeaff851e29

          SHA1

          df4e081002bbcbe3a8a190d69f34697b8aaae04c

          SHA256

          cfd0f369d5d8b2689b4d494613defe443a84041125b49e916750686a7f0cce75

          SHA512

          3173dfa8bcfe8dc9fddef2a950fd1aa762cad2d401827eddc82d6285b9338c447734bed4d926d242a47d7e0d3217fe5f034a9c8d9e268f438230f895ba8bce4b

        • C:\Users\Admin\AppData\Local\alFD2Y78\psr.exe

          Filesize

          232KB

          MD5

          ad53ead5379985081b7c3f1f357e545a

          SHA1

          6f5aa32c1d15fbf073558fadafd046d97b60184e

          SHA256

          4f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f

          SHA512

          433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Eswctkc.lnk

          Filesize

          1KB

          MD5

          f87c68a98d4d931741538b83cab30a3f

          SHA1

          537a5c580ce9b929dd9eb2d186607e23be0e1ff9

          SHA256

          baff0519869bda51bec975e56504ce72ccf1f4260724d210e3436d8660dce87f

          SHA512

          57b4a0eee3787da86801c58254a7dd6f7a96a773e569640a3be4090345000c781a7675ac7e9dd598efb0ce3d9ddfd66c9738110fc16206d4200635ba6ba67518

        • memory/2232-78-0x000002708FB20000-0x000002708FB27000-memory.dmp

          Filesize

          28KB

        • memory/2232-84-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/2644-3-0x00000000007A0000-0x00000000007A7000-memory.dmp

          Filesize

          28KB

        • memory/2644-14-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/2644-0-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3228-50-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

        • memory/3228-49-0x0000021450960000-0x0000021450967000-memory.dmp

          Filesize

          28KB

        • memory/3228-44-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

        • memory/3588-25-0x00007FFC2B380000-0x00007FFC2B390000-memory.dmp

          Filesize

          64KB

        • memory/3588-26-0x0000000000ED0000-0x0000000000ED7000-memory.dmp

          Filesize

          28KB

        • memory/3588-7-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-8-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-11-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-12-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-15-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-33-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-35-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-10-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-5-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

          Filesize

          4KB

        • memory/3588-4-0x00007FFC2A7CA000-0x00007FFC2A7CB000-memory.dmp

          Filesize

          4KB

        • memory/3588-22-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-13-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/3588-9-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/5004-67-0x0000000140000000-0x00000001400C9000-memory.dmp

          Filesize

          804KB

        • memory/5004-64-0x000002216BB20000-0x000002216BB27000-memory.dmp

          Filesize

          28KB