Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 15:35
General
-
Target
export of document 342612.xlsm
-
Size
83KB
-
MD5
bff1d0bc3ea7daf787e62e14d7a87f2f
-
SHA1
679615484ee10e8170ac96f1472e3a54ad2447f0
-
SHA256
b1c932b82e70544a381a0a0ffe1116a71a0dbc1c2b3e5afd63d7ddd0507489ca
-
SHA512
b09fc21d4cd1308967a8bb97a978af2e6ec3c75e21b2a5ba0ba3b5dbf557a2f1050c33c00fbb7b70cb56add7c5ef4a8a9553ecc32b20cfa7661718b6442d6b38
Malware Config
Extracted
dridex
22201
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Downloads MZ/PE file
-
Loads dropped DLL 8 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\export of document 342612.xlsm"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\35650.dll" CreateBitmap2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\35650.dll" CreateBitmap2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
\Users\Admin\AppData\Roaming\35650.dllMD5
6c51689086e55b3b45883de804656313
SHA120faa552a4545ec245b2a2055f77da6e1651c6a8
SHA2567e3e91adad89cc5cea636adb89dac4b3c865be5b303beecf0c5809ee616d82a3
SHA5128c203e0c73342bed77fd2e11907f4c825107dc8c0ea70cfe955ddbf73fe7d09791771d9264c56355818d79410c22f6d5fd90fdc2fa113f08146da556a7d4cc15
-
memory/340-71-0x0000000000000000-mapping.dmp
-
memory/1640-60-0x000000002FE41000-0x000000002FE44000-memory.dmpFilesize
12KB
-
memory/1640-63-0x0000000005AE0000-0x0000000005AE2000-memory.dmpFilesize
8KB
-
memory/1640-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1640-61-0x0000000071081000-0x0000000071083000-memory.dmpFilesize
8KB
-
memory/1652-65-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1652-64-0x0000000000000000-mapping.dmp
-
memory/1652-77-0x0000000010000000-0x000000001002E000-memory.dmpFilesize
184KB
-
memory/1652-79-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB