Analysis
- max time kernel
156s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
08/09/2021, 06:40
General
- Target 5049ada6987bdec4114dfbf0e1ffd20e946c32a2ae608eccb0afdfd28329bcb5.dll
- Size 1.4MB
- Sample210908-hfcatshbdn
- SHA256 5049ada6987bdec4114dfbf0e1ffd20e946c32a2ae608eccb0afdfd28329bcb5
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5049ada6987bdec4114dfbf0e1ffd20e946c32a2ae608eccb0afdfd28329bcb5.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\1Ad\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\1Ad\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\MUD\wscript.exeC:\Users\Admin\AppData\Local\MUD\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\FfQEGcHg\PresentationHost.exeC:\Users\Admin\AppData\Local\FfQEGcHg\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3060-129-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-124-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-131-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-125-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-132-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-134-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-135-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-136-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-137-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-138-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-139-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-140-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-141-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-142-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-143-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-133-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-151-0x00007FF8BE6D4560-0x00007FF8BE6D5560-memory.dmp
memory/3060-120-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3060-122-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-128-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-127-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-121-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-157-0x00007FF8BE810000-0x00007FF8BE812000-memory.dmp
memory/3060-123-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-126-0x0000000140000000-0x0000000140164000-memory.dmp
memory/3060-130-0x0000000140000000-0x0000000140164000-memory.dmp
memory/4360-158-0x0000000140000000-0x0000000140165000-memory.dmp
memory/4408-177-0x000001E0065C0000-0x000001E006725000-memory.dmp
memory/4688-115-0x0000000140000000-0x0000000140164000-memory.dmp
memory/4688-119-0x0000012C338B0000-0x0000012C338B7000-memory.dmp