Overview

overview

10

Static

static

13e7d9f90c...ee.dll

windows7_x64

10

13e7d9f90c...ee.dll

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13/11/2020, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    13e7d9f90c29149575cbcbd95e3500f6405e5a0e4fc55b12e3527a1e773bc4ee.dll
  • Size 1024KB
  • Sample201113-vv74eb223e
  • SHA256 13e7d9f90c29149575cbcbd95e3500f6405e5a0e4fc55b12e3527a1e773bc4ee
  • MD5 SHA1 SHA512
Score
10/10
dridexbotnetevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Modifies registry class 145 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 225 IoCs
  • Suspicious use of FindShellTrayWindow 200 IoCs
  • Suspicious use of SendNotifyMessage 389 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e7d9f90c29149575cbcbd95e3500f6405e5a0e4fc55b12e3527a1e773bc4ee.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e7d9f90c29149575cbcbd95e3500f6405e5a0e4fc55b12e3527a1e773bc4ee.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      PID:1440
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2040
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1776
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1992
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1656
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:336
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1296
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:944
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:1292
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    PID:408
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    PID:1780
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    PID:2012
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:240
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1868
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1644
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1632
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1544
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1596
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1604
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1108
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1968
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1148
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1684
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:608
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:1436
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:588
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies registry class
        PID:1740
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1736

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              memory/240-31-0x00000000039C0000-0x00000000039C1000-memory.dmp
              Download

              memory/944-20-0x0000000003E80000-0x0000000003E81000-memory.dmp
              Download

              memory/1440-1-0x0000000074B50000-0x0000000074BF7000-memory.dmp
              Download

              memory/1596-44-0x0000000004030000-0x0000000004031000-memory.dmp
              Download

              memory/1788-12-0x0000000003780000-0x000000000378E000-memory.dmp
              Download

              memory/1788-16-0x00000000043C0000-0x00000000043C1000-memory.dmp
              Download

              memory/1908-7-0x0000000001CF0000-0x0000000001CF8000-memory.dmp
              Download

              memory/1992-4-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
              Download

              memory/1992-3-0x00000000039D0000-0x00000000039D1000-memory.dmp
              Download

              memory/2012-25-0x0000000003E90000-0x0000000003E91000-memory.dmp
              Download