Overview

overview

10

Static

static

8

Documentation 644.xls

windows7_x64

10

Documentation 644.xls

windows10_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Documentation 644.xls

  • Size

    778KB

  • MD5

    955ddd57164c95530bbff3d5481c0cde

  • SHA1

    38449ef5a84f657d39228df55586fa13cab8d9f1

  • SHA256

    e9e0a2d27876dc9e0fb5e4a9675a23be3f1a8651f72d5774db0e34c0418fcbf8

  • SHA512

    3f502ef2bf16519e0992129a0070efcee4905d88f60b75f1389e39e9549192631ed796f27918b797b0de917e46f3d8c7690201ad0df049e24251844dd0007e38

Score
10/10
dridex111botnetloaderransomware

Malware Config

Extracted

Family

dridex

Botnet

111

C2

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 4 IoCs
  • JavaScript code in executable 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Documentation 644.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1432
  • C:\Windows\system32\wbem\wMIc.exe
    wMIc
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//3ttqn.dll InitHelperDll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//3ttqn.dll InitHelperDll
        3⤵
        • Loads dropped DLL
        PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\2E7EF.xsl
    MD5

    bf8eb8c05f7fef58d868e7b066936a12

    SHA1

    ed97a033371ea71e271506ea015316efa652c6d9

    SHA256

    2219065f014fa13dfc5681b5f675ccd3abef2f515a5abb2d0217d2e8c766270a

    SHA512

    b76d583cfe8718f8933b845fe44521a06e36d63a26094b0f6dc3b42221505f21411682360ce20113bf0904f463eef82424e0913e5930c703069c45a62dd02fb3

    Download Submit
  • C:\Windows\Temp\3ttqn.dll
    MD5

    eb36808c91fe76f09d63c332b8c11a69

    SHA1

    ed11e2cb4e7d176d1e7cb988f548d2582dfae6e5

    SHA256

    3996219367139c590091a24a19f2e3bae6a17185b70ce21dc4e152febefdbb9c

    SHA512

    83e36918a12a8b0dd44da0d7214701c7b0446f0a00697ad1c738a365be6292ba4b4a3cbe43f7c2b97b93687fe4b6356fb1e74ec60645b2f4bbed968f350ad73d

    Download Submit
  • \Windows\Temp\3ttqn.dll
    MD5

    eb36808c91fe76f09d63c332b8c11a69

    SHA1

    ed11e2cb4e7d176d1e7cb988f548d2582dfae6e5

    SHA256

    3996219367139c590091a24a19f2e3bae6a17185b70ce21dc4e152febefdbb9c

    SHA512

    83e36918a12a8b0dd44da0d7214701c7b0446f0a00697ad1c738a365be6292ba4b4a3cbe43f7c2b97b93687fe4b6356fb1e74ec60645b2f4bbed968f350ad73d

    Download Submit
  • \Windows\Temp\3ttqn.dll
    MD5

    eb36808c91fe76f09d63c332b8c11a69

    SHA1

    ed11e2cb4e7d176d1e7cb988f548d2582dfae6e5

    SHA256

    3996219367139c590091a24a19f2e3bae6a17185b70ce21dc4e152febefdbb9c

    SHA512

    83e36918a12a8b0dd44da0d7214701c7b0446f0a00697ad1c738a365be6292ba4b4a3cbe43f7c2b97b93687fe4b6356fb1e74ec60645b2f4bbed968f350ad73d

    Download Submit
  • \Windows\Temp\3ttqn.dll
    MD5

    eb36808c91fe76f09d63c332b8c11a69

    SHA1

    ed11e2cb4e7d176d1e7cb988f548d2582dfae6e5

    SHA256

    3996219367139c590091a24a19f2e3bae6a17185b70ce21dc4e152febefdbb9c

    SHA512

    83e36918a12a8b0dd44da0d7214701c7b0446f0a00697ad1c738a365be6292ba4b4a3cbe43f7c2b97b93687fe4b6356fb1e74ec60645b2f4bbed968f350ad73d

    Download Submit
  • \Windows\Temp\3ttqn.dll
    MD5

    eb36808c91fe76f09d63c332b8c11a69

    SHA1

    ed11e2cb4e7d176d1e7cb988f548d2582dfae6e5

    SHA256

    3996219367139c590091a24a19f2e3bae6a17185b70ce21dc4e152febefdbb9c

    SHA512

    83e36918a12a8b0dd44da0d7214701c7b0446f0a00697ad1c738a365be6292ba4b4a3cbe43f7c2b97b93687fe4b6356fb1e74ec60645b2f4bbed968f350ad73d

    Download Submit
  • memory/780-3-0x000007FEF74A0000-0x000007FEF771A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1168-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1460-6-0x0000000000000000-mapping.dmp
    Download
  • memory/1460-11-0x000000006BA20000-0x000000006BA3F000-memory.dmp
    Filesize

    124KB

    Download