Overview

overview

10

Static

static

8

Reports 78497.xls

windows7_x64

10

Reports 78497.xls

windows10_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    78s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 07:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Reports 78497.xls

  • Size

    875KB

  • MD5

    e452debc1653b43f09dcd98d1f05ba14

  • SHA1

    d68fb05919682ac456701041a955a42d6198b3ef

  • SHA256

    59d0ba2bce05366ad852a51dd0e9387ae38ea0493f9ad8368e47a55903117018

  • SHA512

    a89b049ce90147915cf09bdf36a506afa19f8c440f50a1db0cd1c7437bf522ca977559b4d9ab0a637534b5b5d0fb911e0e5d9104d5b46a91f5a502cfbf6d7413

Score
10/10
dridex111botnetloaderransomware

Malware Config

Extracted

Family

dridex

Botnet

111

C2

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 4 IoCs
  • JavaScript code in executable 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Reports 78497.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1080
  • C:\Windows\system32\wbem\wmic.exe
    wmic
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:304
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//wttct.dll InitHelperDll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//wttct.dll InitHelperDll
        3⤵
        • Loads dropped DLL
        PID:680

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\B638.xsL
    MD5

    700d9ef5283e8dca4a53b60e5674941e

    SHA1

    e6bd6c2d88c640b8983a1cb2f4007c67d205801c

    SHA256

    c893bb57aeb12a781bcb21a5c6c574e53786a0173f1bf45d7ef57860a8956a48

    SHA512

    fe3496c0e5ce6bd84838a6a87ead6e9a8c331ea3bc39c3993a7e6e7c9ae6aabeec3ca1fd3bef87b0f1232658b367820f856593f901d52772dc6e16240a7a7754

    Download Submit
  • C:\Windows\Temp\wttct.dll
    MD5

    8bbe430b0daa1df6999d23dafb861ae6

    SHA1

    04aab742e802811ae214e3154f26111af4e622d6

    SHA256

    103c0c558c81aef0edd76766c46d1fc2759aa0f0b40f38564c60b4a423349808

    SHA512

    311353e2c286458d64f615d7ee58a7621873dba297457be754614afcc95df27a4bef60b3f944d13ddafe594cb764f6469b80e363d766fb5804105ebe13ef7865

    Download Submit
  • \Windows\Temp\wttct.dll
    MD5

    8bbe430b0daa1df6999d23dafb861ae6

    SHA1

    04aab742e802811ae214e3154f26111af4e622d6

    SHA256

    103c0c558c81aef0edd76766c46d1fc2759aa0f0b40f38564c60b4a423349808

    SHA512

    311353e2c286458d64f615d7ee58a7621873dba297457be754614afcc95df27a4bef60b3f944d13ddafe594cb764f6469b80e363d766fb5804105ebe13ef7865

    Download Submit
  • \Windows\Temp\wttct.dll
    MD5

    8bbe430b0daa1df6999d23dafb861ae6

    SHA1

    04aab742e802811ae214e3154f26111af4e622d6

    SHA256

    103c0c558c81aef0edd76766c46d1fc2759aa0f0b40f38564c60b4a423349808

    SHA512

    311353e2c286458d64f615d7ee58a7621873dba297457be754614afcc95df27a4bef60b3f944d13ddafe594cb764f6469b80e363d766fb5804105ebe13ef7865

    Download Submit
  • \Windows\Temp\wttct.dll
    MD5

    8bbe430b0daa1df6999d23dafb861ae6

    SHA1

    04aab742e802811ae214e3154f26111af4e622d6

    SHA256

    103c0c558c81aef0edd76766c46d1fc2759aa0f0b40f38564c60b4a423349808

    SHA512

    311353e2c286458d64f615d7ee58a7621873dba297457be754614afcc95df27a4bef60b3f944d13ddafe594cb764f6469b80e363d766fb5804105ebe13ef7865

    Download Submit
  • \Windows\Temp\wttct.dll
    MD5

    8bbe430b0daa1df6999d23dafb861ae6

    SHA1

    04aab742e802811ae214e3154f26111af4e622d6

    SHA256

    103c0c558c81aef0edd76766c46d1fc2759aa0f0b40f38564c60b4a423349808

    SHA512

    311353e2c286458d64f615d7ee58a7621873dba297457be754614afcc95df27a4bef60b3f944d13ddafe594cb764f6469b80e363d766fb5804105ebe13ef7865

    Download Submit
  • memory/680-6-0x0000000000000000-mapping.dmp
    Download
  • memory/680-11-0x000000006C1F0000-0x000000006C20F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/748-3-0x000007FEF6790000-0x000007FEF6A0A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/916-4-0x0000000000000000-mapping.dmp
    Download