Analysis
- max time kernel
152s - max time network
153s - platform
windows7_x64 - resource
win7v20210408 - submitted
17/09/2021, 09:36
General
- Target 86a2b97f86aa4542f673429e236f244bef4c8e8f9328751e57014d461476c03f.dll
- Size 2.1MB
- Sample210917-lkz48saagm
- SHA256 86a2b97f86aa4542f673429e236f244bef4c8e8f9328751e57014d461476c03f
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86a2b97f86aa4542f673429e236f244bef4c8e8f9328751e57014d461476c03f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\LU9pE2\tcmsetup.exeC:\Users\Admin\AppData\Local\LU9pE2\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\dkwZ\icardagt.exeC:\Users\Admin\AppData\Local\dkwZ\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\ZnmqCOhr0\lpksetup.exeC:\Users\Admin\AppData\Local\ZnmqCOhr0\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/240-135-0x0000000140000000-0x0000000140225000-memory.dmp
memory/240-132-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp
memory/1220-69-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-106-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-84-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-85-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-86-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-87-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-88-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-82-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-72-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-89-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-90-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-91-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-92-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-93-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-68-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-95-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-96-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-94-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-97-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-81-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-66-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-98-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-100-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-99-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-101-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-102-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-103-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-104-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-105-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-83-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-107-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-108-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-109-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-110-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-111-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-112-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-113-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-114-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-115-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-121-0x0000000077DD0000-0x0000000077DD2000-memory.dmp
memory/1220-63-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1220-64-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-80-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-79-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-78-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-77-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-76-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-75-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-74-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-73-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-71-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-70-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-65-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1220-67-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1628-127-0x0000000140000000-0x0000000140226000-memory.dmp
memory/1832-60-0x0000000140000000-0x0000000140224000-memory.dmp
memory/1832-62-0x0000000000190000-0x0000000000197000-memory.dmp