Analysis
- max time kernel
151s - max time network
97s - platform
windows7_x64 - resource
win7v20210408 - submitted
17/09/2021, 09:36
General
- Target 169a95a8e428aed820b3cecb3edfdc797467eee633ef4dbd3bb1b9c3e70408c3.dll
- Size 2.9MB
- Sample210917-lkz48saagj
- SHA256 169a95a8e428aed820b3cecb3edfdc797467eee633ef4dbd3bb1b9c3e70408c3
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\169a95a8e428aed820b3cecb3edfdc797467eee633ef4dbd3bb1b9c3e70408c3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\xKqH\irftp.exeC:\Users\Admin\AppData\Local\xKqH\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\z63UlrZ\dwm.exeC:\Users\Admin\AppData\Local\z63UlrZ\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\x3mL\unregmp2.exeC:\Users\Admin\AppData\Local\x3mL\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1220-95-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-105-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-75-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-76-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-78-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-77-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-79-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-80-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-81-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-82-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-83-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-84-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-85-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-86-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-88-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-87-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-89-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-90-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-91-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-92-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-93-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-94-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-96-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-74-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-97-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-98-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-99-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-100-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/1220-101-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-102-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-103-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-73-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-106-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-104-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-108-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-109-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-107-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-110-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-111-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-112-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-113-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-114-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-115-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-117-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-116-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-72-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-123-0x0000000077000000-0x0000000077002000-memory.dmp
memory/1220-63-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/1220-65-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-64-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-67-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-66-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-71-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-70-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-68-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1220-69-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/1560-129-0x0000000140000000-0x00000001402DC000-memory.dmp
memory/2016-60-0x0000000140000000-0x00000001402DB000-memory.dmp
memory/2016-62-0x0000000000110000-0x0000000000117000-memory.dmp