Overview

overview

10

Static

static

Inv_121314_42664.xlsm

windows7_x64

10

Inv_121314_42664.xlsm

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-11-2020 13:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Inv_121314_42664.xlsm

  • Size

    26KB

  • MD5

    1b109efade90ace7d953507adb1f1563

  • SHA1

    e4eef787b94f80e5374a2058cafc6a37d3fa2c0f

  • SHA256

    2ec35da14989692e77df25d56c7b1d43a3e93a72ec2fc7cce67b2fa448744752

  • SHA512

    4c16f6fcbb91b7a75cf7f1b2bb9938aa4275c0954f9ec1a2b189e100b53e225d0bfb2ae95dd167a794a6e88feb8fece8d05c6ce8149ae975d34886cff32a937f

Score
10/10
dridex10444botnetcryptoneloaderpacker

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

195.154.237.245:443

46.105.131.73:8172

91.238.160.158:18443

213.183.128.99:3786
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • CryptOne packer 4 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Loads dropped DLL 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Inv_121314_42664.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\ymjmxwop._TO
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      PID:1020
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\hhjdagqp._AU
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    MD5

    ce7b1eafeb3fb97b0d88669c7ede5df2

    SHA1

    25777fc1069c4e6bab7e5bad561a1f752f3603f8

    SHA256

    2beecf081111638bb5611f5bdfcfdcbbec9b9948b76bd382c15b94bcf02b8186

    SHA512

    45f7584df91a9e1f577153c8b4ece7758060959f8e2fc18dce384a75bee1d34ce913fc2d1ca227d34d52501bf2a32177ffe61034bad55280ad4f2e3bf0dbb4ed

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\hhjdagqp._AU
    MD5

    745ec2e78f46e4708d61b0c53ff17e9e

    SHA1

    c59243926c629ed640370e78e62ac95645f1d850

    SHA256

    98b86b84236397a88c69916d68734c815b97a00529d1bf513584c81421083e59

    SHA512

    2be9bd3c6870ad57d4feed51337d7e65d5a6d91506c12e2add04760c4cc49ab7ff7890355c5a2c7339de0d848bca815472fc475b250d5012b237b7bf30143b33

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\ymjmxwop._TO
    MD5

    745ec2e78f46e4708d61b0c53ff17e9e

    SHA1

    c59243926c629ed640370e78e62ac95645f1d850

    SHA256

    98b86b84236397a88c69916d68734c815b97a00529d1bf513584c81421083e59

    SHA512

    2be9bd3c6870ad57d4feed51337d7e65d5a6d91506c12e2add04760c4cc49ab7ff7890355c5a2c7339de0d848bca815472fc475b250d5012b237b7bf30143b33

    Download Submit
  • \Users\Admin\AppData\Local\Temp\hhjdagqp._AU
    MD5

    745ec2e78f46e4708d61b0c53ff17e9e

    SHA1

    c59243926c629ed640370e78e62ac95645f1d850

    SHA256

    98b86b84236397a88c69916d68734c815b97a00529d1bf513584c81421083e59

    SHA512

    2be9bd3c6870ad57d4feed51337d7e65d5a6d91506c12e2add04760c4cc49ab7ff7890355c5a2c7339de0d848bca815472fc475b250d5012b237b7bf30143b33

    Download Submit
  • \Users\Admin\AppData\Local\Temp\ymjmxwop._TO
    MD5

    745ec2e78f46e4708d61b0c53ff17e9e

    SHA1

    c59243926c629ed640370e78e62ac95645f1d850

    SHA256

    98b86b84236397a88c69916d68734c815b97a00529d1bf513584c81421083e59

    SHA512

    2be9bd3c6870ad57d4feed51337d7e65d5a6d91506c12e2add04760c4cc49ab7ff7890355c5a2c7339de0d848bca815472fc475b250d5012b237b7bf30143b33

    Download Submit
  • memory/1020-2-0x0000000000000000-mapping.dmp
    Download
  • memory/1020-5-0x00000000008B0000-0x00000000008ED000-memory.dmp
    Filesize

    244KB

    Download
  • memory/1540-1-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1720-6-0x0000000000000000-mapping.dmp
    Download
  • memory/1720-9-0x0000000000690000-0x00000000006CD000-memory.dmp
    Filesize

    244KB

    Download
  • memory/1892-0-0x00000000057D0000-0x00000000057D2000-memory.dmp
    Filesize

    8KB

    Download