Analysis
- max time kernel
156s - max time network
138s - platform
windows10_x64 - resource
win10-en - submitted
16/09/2021, 08:17
General
- Target fbc0696d187cc64db436f4922031d3326a99a3c8646a9b4baf84f00631417b69.dll
- Size 2.1MB
- Sample210916-j6qftafdal
- SHA256 fbc0696d187cc64db436f4922031d3326a99a3c8646a9b4baf84f00631417b69
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbc0696d187cc64db436f4922031d3326a99a3c8646a9b4baf84f00631417b69.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\JPh\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\JPh\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\jjDHK\psr.exeC:\Users\Admin\AppData\Local\jjDHK\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\2IB\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\2IB\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3032-147-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-153-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-130-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-131-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-132-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-133-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-134-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-135-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-136-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-137-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-139-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-138-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-140-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-141-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-142-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-143-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-144-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-145-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-146-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-129-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-148-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-149-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-150-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-151-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-152-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-128-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-154-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-155-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-156-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-157-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-158-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-159-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-160-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-161-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-162-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-170-0x00007FF953C54560-0x00007FF953C55560-memory.dmp
memory/3032-172-0x00007FF953B90000-0x00007FF953BA0000-memory.dmp
memory/3032-120-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/3032-122-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-123-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-124-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-127-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-121-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-125-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3032-126-0x0000000140000000-0x0000000140217000-memory.dmp
memory/3636-119-0x000001A002660000-0x000001A002667000-memory.dmp
memory/3636-115-0x0000000140000000-0x0000000140217000-memory.dmp
memory/4080-177-0x0000000140000000-0x0000000140218000-memory.dmp