Analysis
- max time kernel
151s - max time network
127s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
21/09/2021, 08:29
General
- Target 5fefa719c11c0ad8472f9c610aaa9cd4a487077ed06aca94fe71dd20cd486394.dll
- Size 2.5MB
- Sample210921-kdk63abebr
- SHA256 5fefa719c11c0ad8472f9c610aaa9cd4a487077ed06aca94fe71dd20cd486394
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fefa719c11c0ad8472f9c610aaa9cd4a487077ed06aca94fe71dd20cd486394.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bcastdvr.exeC:\Windows\system32\bcastdvr.exe1⤵
-
C:\Users\Admin\AppData\Local\RUyppG\bcastdvr.exeC:\Users\Admin\AppData\Local\RUyppG\bcastdvr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\mgB\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\mgB\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\INRd1\mblctr.exeC:\Users\Admin\AppData\Local\INRd1\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3048-149-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-151-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-130-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-131-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-124-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-132-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-133-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-134-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-135-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-136-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-137-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-138-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-139-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-140-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-141-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-142-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-143-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-144-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-145-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-146-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-147-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-148-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-129-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-150-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-152-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-153-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-154-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-127-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-155-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-156-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-157-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-158-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-159-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-160-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-161-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-162-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-163-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-164-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-165-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-173-0x00007FFC16244560-0x00007FFC16245560-memory.dmp
memory/3048-175-0x00007FFC16190000-0x00007FFC161A0000-memory.dmp
memory/3048-120-0x0000000000440000-0x0000000000441000-memory.dmp
memory/3048-121-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-128-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-122-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-123-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-126-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3048-125-0x0000000140000000-0x000000014027F000-memory.dmp
memory/3608-119-0x0000015E00410000-0x0000015E00417000-memory.dmp
memory/3608-115-0x0000000140000000-0x000000014027F000-memory.dmp
memory/4472-190-0x0000000140000000-0x00000001402C5000-memory.dmp
memory/4528-181-0x0000000140000000-0x0000000140280000-memory.dmp