Analysis
- max time kernel
174s - max time network
146s - platform
windows7_x64 - resource
win7-en - submitted
09/09/2021, 11:54
General
- Target 994af9a2c1fe96e94a95f0bc85bb6a6fcac476d812a66ed4fd2f9055b34c5f43.dll
- Size 1.7MB
- Sample210909-n2x3babcbl
- SHA256 994af9a2c1fe96e94a95f0bc85bb6a6fcac476d812a66ed4fd2f9055b34c5f43
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\994af9a2c1fe96e94a95f0bc85bb6a6fcac476d812a66ed4fd2f9055b34c5f43.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\VEgjT\shrpubw.exeC:\Users\Admin\AppData\Local\VEgjT\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgrade.exeC:\Windows\system32\WindowsAnytimeUpgrade.exe1⤵
-
C:\Users\Admin\AppData\Local\RmsaVZ\WindowsAnytimeUpgrade.exeC:\Users\Admin\AppData\Local\RmsaVZ\WindowsAnytimeUpgrade.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\4Lp9UyN\wextract.exeC:\Users\Admin\AppData\Local\4Lp9UyN\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/868-104-0x0000000140000000-0x00000001401B9000-memory.dmp
memory/868-101-0x000007FEFB651000-0x000007FEFB653000-memory.dmp
memory/1116-53-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1116-55-0x0000000000120000-0x0000000000127000-memory.dmp
memory/1280-73-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-85-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-81-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-80-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-79-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-78-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-77-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-75-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-71-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-70-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-69-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-68-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-67-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-91-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-90-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-89-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-88-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-87-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-86-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-82-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-84-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-97-0x0000000076F80000-0x0000000076F82000-memory.dmp
memory/1280-83-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-76-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-72-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-74-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-64-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-66-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-65-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-60-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-63-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-56-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/1280-62-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-61-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-57-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-59-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1280-58-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/1660-113-0x000007FEF5470000-0x000007FEF55D2000-memory.dmp