Overview

overview

10

Static

static

8

sample2021...1.xlsm

windows7_x64

10

sample2021...1.xlsm

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    21-01-2021 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample20210121-01.xlsm

  • Size

    30KB

  • MD5

    d89d70ee6809ef93910bfbf10c4caf94

  • SHA1

    5e8d4db8464fd6d427d5987ae6cb017ceac13839

  • SHA256

    55cbb43aad59d149ba4bc06684771b5d87a3f570da165437c4d07d442d4b8db7

  • SHA512

    c5eb5a46edb4cf9a7eeeb7e945665f9091d2b536310d5e4de54d47fca8690821c28c004a4677daae1273911f8e60d467cd8424f2e7e23e12f20ac589bb6d5073

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

dridex

Botnet

10444

C2

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\sample20210121-01.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\ujnbvjlt.dll
      2⤵
      • Process spawned unexpected child process
      PID:1976
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\ujnbvjlt.dll
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ujnbvjlt.dll
    MD5

    002c56165a0e78369d0e1023ce044bf0

    SHA1

    78ebfe4167a851bc75d9702aa1aea5efe1514b0c

    SHA256

    a5ffce2a8d98ddc0ccc20744e88443eac323caf1cd8a218b8ccd50bc5ab8f1ac

    SHA512

    bb6796d16c54e3521b4207323e7f774f9469d80b7aeb1d270b9f45034dd26ca801d9f8ed5130994ee0c7e35e084b33b7a90e6eef6295be4b53cf77a61c927d2a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\ujnbvjlt.dll
    MD5

    002c56165a0e78369d0e1023ce044bf0

    SHA1

    78ebfe4167a851bc75d9702aa1aea5efe1514b0c

    SHA256

    a5ffce2a8d98ddc0ccc20744e88443eac323caf1cd8a218b8ccd50bc5ab8f1ac

    SHA512

    bb6796d16c54e3521b4207323e7f774f9469d80b7aeb1d270b9f45034dd26ca801d9f8ed5130994ee0c7e35e084b33b7a90e6eef6295be4b53cf77a61c927d2a

    Download Submit
  • memory/848-8-0x0000000000000000-mapping.dmp
    Download
  • memory/848-12-0x000000006BF60000-0x000000006BF9D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/848-13-0x000000006BF60000-0x000000006BF9D000-memory.dmp
    Filesize

    244KB

    Download
  • memory/848-14-0x0000000000140000-0x0000000000141000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1108-2-0x000000002FEC1000-0x000000002FEC4000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1108-3-0x0000000071251000-0x0000000071253000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1888-7-0x000007FEF7510000-0x000007FEF778A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1976-5-0x0000000000000000-mapping.dmp
    Download
  • memory/1976-6-0x00000000760D1000-0x00000000760D3000-memory.dmp
    Filesize

    8KB

    Download