Analysis
- max time kernel
154s - max time network
74s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/09/2021, 06:03
General
- Target dbde32d668cce3c71b47d77e63be2b0908bca001fa34c1eed66e0fa5c8f1f0e2.dll
- Size 3.8MB
- Sample210924-gr2jesfhfm
- SHA256 dbde32d668cce3c71b47d77e63be2b0908bca001fa34c1eed66e0fa5c8f1f0e2
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbde32d668cce3c71b47d77e63be2b0908bca001fa34c1eed66e0fa5c8f1f0e2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\kYxU9GNyv\BdeUISrv.exeC:\Users\Admin\AppData\Local\kYxU9GNyv\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\nM8\tcmsetup.exeC:\Users\Admin\AppData\Local\nM8\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\pspj4\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\pspj4\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-114-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/664-118-0x000001A1D3C70000-0x000001A1D3C77000-memory.dmp
memory/3024-150-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-157-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-126-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-127-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-128-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-129-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-130-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-131-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-132-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-133-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-134-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-135-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-136-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-137-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-138-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-139-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-140-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-141-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-142-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-143-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-144-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-145-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-146-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-147-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-148-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-149-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-124-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-151-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-152-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-153-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-154-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-155-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-156-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-125-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-158-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-159-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-160-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-161-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-162-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-163-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-164-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-165-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-166-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-167-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-168-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-170-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-169-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-172-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-171-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-174-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-173-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-175-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-176-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-177-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-178-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-123-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-122-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-179-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-180-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-204-0x00007FFAEC780000-0x00007FFAEC782000-memory.dmp
memory/3024-119-0x0000000002630000-0x0000000002631000-memory.dmp
memory/3024-121-0x0000000140000000-0x00000001403D6000-memory.dmp
memory/3024-120-0x0000000140000000-0x00000001403D6000-memory.dmp