Analysis
- max time kernel
160s - max time network
140s - platform
windows7_x64 - resource
win7-en - submitted
16/09/2021, 08:23
General
- Target 8f3aada3f4b53e00902e37e055b7d800a220c960b85d3e66cdc1530ec4654500.dll
- Size 2.3MB
- Sample210916-j98fssfddk
- SHA256 8f3aada3f4b53e00902e37e055b7d800a220c960b85d3e66cdc1530ec4654500
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SendNotifyMessage 27 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f3aada3f4b53e00902e37e055b7d800a220c960b85d3e66cdc1530ec4654500.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\16Y7\DisplaySwitch.exeC:\Users\Admin\AppData\Local\16Y7\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\Jtyd2o1X\mmc.exeC:\Users\Admin\AppData\Local\Jtyd2o1X\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\rFKMj\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\rFKMj\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-53-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1052-55-0x0000000000190000-0x0000000000197000-memory.dmp
memory/1208-80-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-72-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-83-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-85-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-84-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-82-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-81-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-94-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-93-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-92-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-99-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-98-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-97-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-96-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-95-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-91-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-90-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-89-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-88-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-87-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-86-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-79-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-76-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-74-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-73-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-77-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-71-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-69-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-68-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-67-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-66-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-105-0x0000000077960000-0x0000000077962000-memory.dmp
memory/1208-78-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-75-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-56-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1208-57-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-70-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-65-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-58-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-60-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-59-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-61-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-62-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-63-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1208-64-0x0000000140000000-0x000000014024C000-memory.dmp
memory/1636-112-0x0000000140000000-0x000000014024D000-memory.dmp
memory/1636-109-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp