Analysis
- max time kernel
154s - max time network
149s - platform
windows10_x64 - resource
win10-en - submitted
17/09/2021, 09:38
General
- Target 8cfbaaadf5480a9dd8b8f9269e49286890c9ccbfb7dff8b2aef52b0f0bbf319e.dll
- Size 2.5MB
- Sample210917-ll5fcaaagq
- SHA256 8cfbaaadf5480a9dd8b8f9269e49286890c9ccbfb7dff8b2aef52b0f0bbf319e
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8cfbaaadf5480a9dd8b8f9269e49286890c9ccbfb7dff8b2aef52b0f0bbf319e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\ZgTFxd30\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\ZgTFxd30\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\CEiHGzZP\AgentService.exeC:\Users\Admin\AppData\Local\CEiHGzZP\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\ZeYHGU\recdisc.exeC:\Users\Admin\AppData\Local\ZeYHGU\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3016-148-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-151-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-128-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-129-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-130-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-131-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-132-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-133-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-134-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-135-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-136-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-137-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-138-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-139-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-140-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-141-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-143-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-142-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-144-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-145-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-146-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-126-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-147-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-149-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-150-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-127-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-152-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-153-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-155-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-157-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-156-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-154-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-158-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-159-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-160-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-161-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-162-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-163-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-171-0x00007FFDC37D4560-0x00007FFDC37D5560-memory.dmp
memory/3016-173-0x00007FFDC3910000-0x00007FFDC3912000-memory.dmp
memory/3016-120-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/3016-121-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-122-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-123-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-124-0x0000000140000000-0x000000014027D000-memory.dmp
memory/3016-125-0x0000000140000000-0x000000014027D000-memory.dmp
memory/4648-117-0x0000021233E00000-0x0000021233E07000-memory.dmp
memory/4648-115-0x0000000140000000-0x000000014027D000-memory.dmp
memory/4972-178-0x0000000140000000-0x000000014027E000-memory.dmp