Analysis
- max time kernel
153s - max time network
136s - platform
windows10_x64 - resource
win10-en - submitted
09/09/2021, 11:53
General
- Target 5c3d1fee926215e8ef62c8e6662ee37baf104ae3a2cb403391ea6caa4b630dca.dll
- Size 1.7MB
- Sample210909-n2axsabcbk
- SHA256 5c3d1fee926215e8ef62c8e6662ee37baf104ae3a2cb403391ea6caa4b630dca
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Drops startup file 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c3d1fee926215e8ef62c8e6662ee37baf104ae3a2cb403391ea6caa4b630dca.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\m2J23A856\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\m2J23A856\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\03kqq\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\03kqq\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\I7JbMe8M\mspaint.exeC:\Users\Admin\AppData\Local\I7JbMe8M\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1136-194-0x0000000140000000-0x00000001401BD000-memory.dmp
memory/1692-115-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/1692-119-0x000001E6135F0000-0x000001E6135F7000-memory.dmp
memory/2996-170-0x0000000140000000-0x00000001401BC000-memory.dmp
memory/3048-132-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-153-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-136-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-137-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-138-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-139-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-140-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-141-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-142-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-143-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-144-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-146-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-145-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-147-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-148-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-149-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-150-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-151-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-152-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-135-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-154-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-155-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-156-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-164-0x00007FFCB7554560-0x00007FFCB7555560-memory.dmp
memory/3048-134-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-133-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-131-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-130-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-129-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-177-0x00007FFCB7690000-0x00007FFCB7692000-memory.dmp
memory/3048-127-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-120-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/3048-128-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-126-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-125-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-124-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-123-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-122-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3048-121-0x0000000140000000-0x00000001401BB000-memory.dmp