Analysis
- max time kernel
151s - max time network
118s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/09/2021, 11:52
General
- Target 92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220.dll
- Size 1.8MB
- Sample210909-n1rtxabcan
- SHA256 92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92762268ad64214f533f6630484ac6d5fc13a3e3d64e4e0c19b21841dd049220.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\DEh\dpapimig.exeC:\Users\Admin\AppData\Local\DEh\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\bTP8PE\BdeUISrv.exeC:\Users\Admin\AppData\Local\bTP8PE\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EaseOfAccessDialog.exeC:\Windows\system32\EaseOfAccessDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\GiLSbvAUO\EaseOfAccessDialog.exeC:\Users\Admin\AppData\Local\GiLSbvAUO\EaseOfAccessDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-145-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-149-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-128-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-129-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-130-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-131-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-132-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-133-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-134-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-135-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-136-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-137-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-138-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-139-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-140-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-141-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-142-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-143-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-144-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-119-0x0000000000530000-0x0000000000531000-memory.dmp
memory/8-146-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-147-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-148-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-127-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-150-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-151-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-152-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-153-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-154-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-155-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-156-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-164-0x00007FFD6ADD4560-0x00007FFD6ADD5560-memory.dmp
memory/8-166-0x00007FFD6AF10000-0x00007FFD6AF12000-memory.dmp
memory/8-120-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-126-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-125-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-121-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-124-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-122-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/8-123-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/900-114-0x0000000140000000-0x00000001401C8000-memory.dmp
memory/900-118-0x0000016EFDD20000-0x0000016EFDD27000-memory.dmp
memory/1324-171-0x0000000140000000-0x000000014020E000-memory.dmp
memory/2076-180-0x0000000140000000-0x00000001401C9000-memory.dmp