Overview

overview

10

Static

static

8

Contract 30964.xls

windows7_x64

10

Contract 30964.xls

windows10_x64

10

Analysis

  • max time kernel
    97s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Contract 30964.xls

  • Size

    727KB

  • MD5

    c84236e6997a25861e15d5d44a7d207e

  • SHA1

    f4b0cad4dfa47c8ce6feaaeea3ee3ef79708ffe5

  • SHA256

    4b365dadb8a5d68b5ff999a1b5991aa0cad00852e0ed7517c4748ecc5f402558

  • SHA512

    ca35ae9393899391a9593d2f0c94d04314c267c4385fd96b06776c066cfa3bc42db6c348a622349cbc4315352fb63213c105c47a9c198f417b898bddf8105058

Score
10/10
dridex111botnetloaderransomware

Malware Config

Extracted

Family

dridex

Botnet

111

C2

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 4 IoCs
  • JavaScript code in executable 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Contract 30964.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1864
  • C:\Windows\system32\wbem\wmiC.exe
    wmiC
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//sl2en.dll InitHelperDll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//sl2en.dll InitHelperDll
        3⤵
        • Loads dropped DLL
        PID:1732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\22318.Xsl
    MD5

    e3a79122a87bf19fdf4806107057fd76

    SHA1

    bb37c6e0105f7cf0b1d493bdc70461cf9205adb3

    SHA256

    0b3882afb92516477f07439957421c7cc89eb4119d85a80a69047be15802f09f

    SHA512

    15860e164cbc1cca8d92acd509ed2dbc5c3c537d7ee422f9183ce635039a3ca41483ec5a8f5d28527490931f95870aeab44a804e5b7658ce377d0ee6c5f5850e

    Download Submit
  • C:\Windows\Temp\sl2en.dll
    MD5

    c45ef6142230047ca13bd72f2f3b8f80

    SHA1

    3ca3f4052958685b2c1a7163a4a4f8eb38d0a4d2

    SHA256

    cc05c0a87867cb50221d88668dc86dbae0310aec8c6dad52b19261f35309d56d

    SHA512

    77e707ffe05ed7ed2a5167cde2fa38e6fd6bf11fefa4a00fe89b26c62a5710f6fe877b54aeba19247377b27ab89e7ab70f40a88bd64eb1cc6a478ec91174860b

    Download Submit
  • \Windows\Temp\sl2en.dll
    MD5

    c45ef6142230047ca13bd72f2f3b8f80

    SHA1

    3ca3f4052958685b2c1a7163a4a4f8eb38d0a4d2

    SHA256

    cc05c0a87867cb50221d88668dc86dbae0310aec8c6dad52b19261f35309d56d

    SHA512

    77e707ffe05ed7ed2a5167cde2fa38e6fd6bf11fefa4a00fe89b26c62a5710f6fe877b54aeba19247377b27ab89e7ab70f40a88bd64eb1cc6a478ec91174860b

    Download Submit
  • \Windows\Temp\sl2en.dll
    MD5

    c45ef6142230047ca13bd72f2f3b8f80

    SHA1

    3ca3f4052958685b2c1a7163a4a4f8eb38d0a4d2

    SHA256

    cc05c0a87867cb50221d88668dc86dbae0310aec8c6dad52b19261f35309d56d

    SHA512

    77e707ffe05ed7ed2a5167cde2fa38e6fd6bf11fefa4a00fe89b26c62a5710f6fe877b54aeba19247377b27ab89e7ab70f40a88bd64eb1cc6a478ec91174860b

    Download Submit
  • \Windows\Temp\sl2en.dll
    MD5

    c45ef6142230047ca13bd72f2f3b8f80

    SHA1

    3ca3f4052958685b2c1a7163a4a4f8eb38d0a4d2

    SHA256

    cc05c0a87867cb50221d88668dc86dbae0310aec8c6dad52b19261f35309d56d

    SHA512

    77e707ffe05ed7ed2a5167cde2fa38e6fd6bf11fefa4a00fe89b26c62a5710f6fe877b54aeba19247377b27ab89e7ab70f40a88bd64eb1cc6a478ec91174860b

    Download Submit
  • \Windows\Temp\sl2en.dll
    MD5

    c45ef6142230047ca13bd72f2f3b8f80

    SHA1

    3ca3f4052958685b2c1a7163a4a4f8eb38d0a4d2

    SHA256

    cc05c0a87867cb50221d88668dc86dbae0310aec8c6dad52b19261f35309d56d

    SHA512

    77e707ffe05ed7ed2a5167cde2fa38e6fd6bf11fefa4a00fe89b26c62a5710f6fe877b54aeba19247377b27ab89e7ab70f40a88bd64eb1cc6a478ec91174860b

    Download Submit
  • memory/316-4-0x0000000000000000-mapping.dmp
    Download
  • memory/544-3-0x000007FEF7810000-0x000007FEF7A8A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1732-6-0x0000000000000000-mapping.dmp
    Download
  • memory/1732-11-0x000000006B8D0000-0x000000006B8EF000-memory.dmp
    Filesize

    124KB

    Download