Overview

overview

10

Static

static

8

Invoice(s)...L.xlsm

windows7_x64

1

Invoice(s)...L.xlsm

windows10_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 15:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice(s) for Order _071185/071185_BOL.xlsm

  • Size

    40KB

  • MD5

    1573b4ec83ac67af060289a37896b0c9

  • SHA1

    b95d31d6b268f4382c438ba8cdb2d6fae9e23572

  • SHA256

    fd2cc0c858b7b92b32d86f7bb8a48d56798667a2bc7e75fe44f074178ea3a0d6

  • SHA512

    925e02a2f062cf4732335b28765779973d6db9d89c52016326aef577b0e76ee07bb8beb386545f9551aa2e4c811f6d432c9dda90cfedc6e0ed72f042808fd3b9

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

210.65.244.184:443

147.78.186.4:10051

62.75.168.152:6601
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice(s) for Order _071185\071185_BOL.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\vrbhfroh.dll
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:420
      • C:\Windows\SysWOW64\regsvr32.exe
        -s C:\Users\Admin\AppData\Local\Temp\vrbhfroh.dll
        3⤵
        • Loads dropped DLL
        PID:1892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vrbhfroh.dll
    MD5

    9da3ac5eeb02e9e4afd27b1744af5c67

    SHA1

    37ab0fb581035cd53fca86855e3acbfe3eb15e9f

    SHA256

    5b965759f9af66ad12e3fcbf71481799926417240c8cfbd1445d4867238631b8

    SHA512

    7613692f5555f7b33834ad634cbf56c4e924325bf9077be10132fa3c2295741b3f92fad00d21f2fd1caa3ca0103c604cbee41fc66bd5feeb5e84112ddd7ce363

    Download Submit
  • \Users\Admin\AppData\Local\Temp\vrbhfroh.dll
    MD5

    9da3ac5eeb02e9e4afd27b1744af5c67

    SHA1

    37ab0fb581035cd53fca86855e3acbfe3eb15e9f

    SHA256

    5b965759f9af66ad12e3fcbf71481799926417240c8cfbd1445d4867238631b8

    SHA512

    7613692f5555f7b33834ad634cbf56c4e924325bf9077be10132fa3c2295741b3f92fad00d21f2fd1caa3ca0103c604cbee41fc66bd5feeb5e84112ddd7ce363

    Download Submit
  • memory/420-7-0x0000000000000000-mapping.dmp
    Download
  • memory/1108-2-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-3-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-4-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1108-5-0x00007FFC47C80000-0x00007FFC482B7000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1108-6-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1892-9-0x0000000000000000-mapping.dmp
    Download
  • memory/1892-11-0x0000000073580000-0x00000000735BD000-memory.dmp
    Filesize

    244KB

    Download
  • memory/1892-12-0x0000000073580000-0x00000000735BD000-memory.dmp
    Filesize

    244KB

    Download
  • memory/1892-13-0x0000000000D50000-0x0000000000D51000-memory.dmp
    Filesize

    4KB

    Download