Overview

overview

10

Static

static

Invoice_00...0.xlsm

windows7_x64

10

Invoice_00...0.xlsm

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-11-2020 13:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice_005241060.xlsm

  • Size

    29KB

  • MD5

    ef3b7f93392bee34ef3a27b9dd95b148

  • SHA1

    f35848fdcc1900e68d7bae5818f0dbe6b58ebe48

  • SHA256

    406ae986c72382231fae46850d054ce174f5a70ccf948d21d8e48663c16ec081

  • SHA512

    57f6386b615406f2768b9837889dfe00bf17d04d63505f22eee49725c0ee57adda790bcbff38ca388e025df2b8e51e3d924029c666711d3da32a182157ae4220

Score
10/10
dridex10444botnetcryptoneloaderpacker

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

77.220.64.53:443

172.96.190.154:4664

209.126.111.137:33443

167.99.158.82:33443
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice_005241060.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\ynkxyye.TMP
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      PID:1464
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\vqumiag.TMP
      2⤵
      • Process spawned unexpected child process
      PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ynkxyye.TMP
    MD5

    8ca3a31bb6de0d149346791288a216e9

    SHA1

    828d199b68cdb33d136768249c98d985b0771151

    SHA256

    4bbf766e8ac0148b77e659e3a3cfd110c6f219468c240987874c03107b4f8826

    SHA512

    39f0d5311e5f68fb3e751a9835cdb45e0a62ad44fb85d9da13ed6fc369d948898586c60ca8ba3c67299ec80763229bad88151291077d8add23b024d531a53cfb

    Download Submit
  • \Users\Admin\AppData\Local\Temp\ynkxyye.TMP
    MD5

    8ca3a31bb6de0d149346791288a216e9

    SHA1

    828d199b68cdb33d136768249c98d985b0771151

    SHA256

    4bbf766e8ac0148b77e659e3a3cfd110c6f219468c240987874c03107b4f8826

    SHA512

    39f0d5311e5f68fb3e751a9835cdb45e0a62ad44fb85d9da13ed6fc369d948898586c60ca8ba3c67299ec80763229bad88151291077d8add23b024d531a53cfb

    Download Submit
  • memory/1212-1-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1464-2-0x0000000000000000-mapping.dmp
    Download
  • memory/1464-6-0x0000000000340000-0x000000000037D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/1632-5-0x0000000000000000-mapping.dmp
    Download
  • memory/1772-0-0x000000000576E000-0x0000000005777000-memory.dmp
    Filesize

    36KB

    Download