Analysis
- max time kernel
151s - max time network
140s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/07/2021, 00:51
General
- Target c6f2239754469a59c8f97e30df2e0950.xls
- Size 315KB
- Sample210722-prpyahwfbe
- SHA256 e028f271461ba72f91934ada56064d0eab66b4ad3066d653632fad04351efb00
Malware Config
Extracted
-
dridex
-
22202
-
178.238.236.59:443
-
104.245.52.73:5007
-
81.0.236.93:13786
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c6f2239754469a59c8f97e30df2e0950.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta C:\ProgramData//klRangeAutoFormatReport9.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\ProgramData\qPlus.dll,SetRealTimeUsage3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qPlus.dll,SetRealTimeUsage4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-117-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-118-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-119-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-122-0x00007FFCABB60000-0x00007FFCACC4E000-memory.dmp
memory/568-123-0x00007FFCA9C60000-0x00007FFCABB55000-memory.dmp
memory/568-69759-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-114-0x00007FF6EE2E0000-0x00007FF6F1896000-memory.dmp
memory/568-69757-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-116-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-69753-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-115-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/568-69755-0x00007FFC8B990000-0x00007FFC8B9A0000-memory.dmp
memory/636-278-0x0000000000A00000-0x0000000000B4A000-memory.dmp
memory/636-276-0x00000000742F0000-0x0000000074321000-memory.dmp