Overview

overview

10

Static

static

8

INV3853544...5.xlsm

windows7_x64

1

INV3853544...5.xlsm

windows10_x64

10

Analysis

  • max time kernel
    111s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 18:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INV3853544448-20210315515345.xlsm

  • Size

    40KB

  • MD5

    fbdc93eba3d85daa84b15b534d01ad86

  • SHA1

    b60035635c6dabd34f35ed5729df7ada641d51d3

  • SHA256

    6e4dd80fc7a0b4a9ccb96d35ea609227f1e89274b3836f424d9ecbb43791c75d

  • SHA512

    5b777f564c35d04de6faae13993fdad2f6ec2a95c4922488cd47e752b7643f0ea74f43693c8944ba4544fc4eaa4b87fd7196a1c9996c8fd21d166c4f14258a3a

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

210.65.244.184:443

147.78.186.4:10051

62.75.168.152:6601
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Loads dropped DLL 1 IoCs
  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\INV3853544448-20210315515345.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\mjjqqdid.dll
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\SysWOW64\regsvr32.exe
        -s C:\Users\Admin\AppData\Local\Temp\mjjqqdid.dll
        3⤵
        • Loads dropped DLL
        PID:3812
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4520
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4520
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
          4⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
    MD5

    9b233f391290766d91f7c8a28ecc7d2f

    SHA1

    c479ed60c54790241d0d787ad49113a4a6028558

    SHA256

    09e656e9ae5566784e16ee479dda2127ac63cec126832cec69fc54579526a73a

    SHA512

    4494a30d5bf48d0ea61cef7da1ce11b01b97620ac62409576c8628105b3e7cbc1b3cdd84f7ad3581be1341f9a7b02089d0557088407332461b145e1db5ae0519

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
    MD5

    b0883b46cc5c8c49659118d9e75fd288

    SHA1

    fd114bca0732123c41e94e95d03b6287815f0a3e

    SHA256

    80821cdb5fc5c78b1c6a4ee32d7305fb5dd431a3ce381af83ffc504c9a119bab

    SHA512

    e2a1dda779e568bd2cfa8790f3f0b12f0057c4d2ddbd0529dfe49e9d6d9bd5cee11505a97612eb5c61a39ecc0056f3e1ddebf12eac8cb083bbad76a96bc4395d

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
    MD5

    dfb51782472d67c85c27f55aedfeb882

    SHA1

    420a0a93bc8d9a76e86ec9ee63431a4248c1628f

    SHA256

    b996ae970552c37d830808f00caec35b2cc9985fb1b6825cdeed827384181b60

    SHA512

    19f01e17ef2391ec878023fe995ce2daad7488022697acffde48fc78e39143fc07c4cfb3f221407b17a1592d3fc81f76c377fe8313f20d16ab24f83d493df10f

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
    MD5

    f138a66469c10d5761c6cbb36f2163c3

    SHA1

    eea136206474280549586923b7a4a3c6d5db1e25

    SHA256

    c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6

    SHA512

    9d25f943b6137dd2981ee75d57baf3a9e0ee27eea2df19591d580f02ec8520d837b8e419a8b1eb7197614a3c6d8793c56ebc848c38295ada23c31273daa302d9

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
    MD5

    9737955b38dd3037d9d464ee1f297d71

    SHA1

    d97a787c20cf21e1507859a154779ea5497c66a3

    SHA256

    b6660576319c51a429efa7d60bad3735504608cb23118f267393facea57f244c

    SHA512

    da4daf70addcf83d90d0d97027b5e69939f32406a343fd6e85baf517ee7037ed592214cca38b696d60555176516aaf46e6d725888ab8c72019f0ab99fee3ef0c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\mjjqqdid.dll
    MD5

    212941a94cfe78b7fa3b289f87a0874b

    SHA1

    7d2f413a5aaaf35cadf82ca8a663ed78a9a41183

    SHA256

    a1fd4ce78a39238737d9dbded58575890d95e0cb72079a98abdf6932d13774f3

    SHA512

    1d7a203dd3ee73740187edd1d99de01b2ed0026f1d29b4dd13cc75b192e5c4c53196d800bf18e54614e0cc667b8bf41b4397a0448be6e9a0d9ec1e7ffd2cb68a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    MD5

    4fcb2a3ee025e4a10d21e1b154873fe2

    SHA1

    57658e2fa594b7d0b99d02e041d0f3418e58856b

    SHA256

    90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

    SHA512

    4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

    Download Submit
  • \Users\Admin\AppData\Local\Temp\mjjqqdid.dll
    MD5

    212941a94cfe78b7fa3b289f87a0874b

    SHA1

    7d2f413a5aaaf35cadf82ca8a663ed78a9a41183

    SHA256

    a1fd4ce78a39238737d9dbded58575890d95e0cb72079a98abdf6932d13774f3

    SHA512

    1d7a203dd3ee73740187edd1d99de01b2ed0026f1d29b4dd13cc75b192e5c4c53196d800bf18e54614e0cc667b8bf41b4397a0448be6e9a0d9ec1e7ffd2cb68a

    Download Submit
  • memory/1108-6-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-2-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-5-0x00007FFC480E0000-0x00007FFC48717000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1108-4-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-3-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1576-10-0x0000000000000000-mapping.dmp
    Download
  • memory/1576-42-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1576-46-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1576-45-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1576-43-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2204-37-0x0000000000000000-mapping.dmp
    Download
  • memory/2204-41-0x00007FFC48140000-0x00007FFC48777000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2560-16-0x0000018F6F190000-0x0000018F6F191000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-27-0x0000018F6FC20000-0x0000018F6FC21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-26-0x0000018F6FC20000-0x0000018F6FC21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-25-0x0000018F6FC20000-0x0000018F6FC21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-19-0x0000018F6F8D0000-0x0000018F6F8D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-22-0x0000018F6FCD0000-0x0000018F6FCD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-15-0x0000018F6F190000-0x0000018F6F191000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2560-14-0x0000000000000000-mapping.dmp
    Download
  • memory/3812-9-0x0000000000000000-mapping.dmp
    Download
  • memory/3812-53-0x0000000073580000-0x00000000735BD000-memory.dmp
    Filesize

    244KB

    Download
  • memory/3812-54-0x0000000073580000-0x00000000735BD000-memory.dmp
    Filesize

    244KB

    Download
  • memory/3812-55-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3820-7-0x0000000000000000-mapping.dmp
    Download