Analysis
- max time kernel
164s - max time network
103s - platform
windows7_x64 - resource
win7v20210408 - submitted
28/09/2021, 09:27
General
- Target cc7570a8f00ca7bb7fcbf3b585f1125b7ca7c2214064ca9bf8bcbddad224823c.dll
- Size 1.1MB
- Sample210928-ler7fabeem
- SHA256 cc7570a8f00ca7bb7fcbf3b585f1125b7ca7c2214064ca9bf8bcbddad224823c
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Payload 2 IoCs
Detects Dridex x64 core DLL in memory.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc7570a8f00ca7bb7fcbf3b585f1125b7ca7c2214064ca9bf8bcbddad224823c.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\LAC\osk.exeC:\Users\Admin\AppData\Local\LAC\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\NQlPV9Yv\rekeywiz.exeC:\Users\Admin\AppData\Local\NQlPV9Yv\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\5xB\rstrui.exeC:\Users\Admin\AppData\Local\5xB\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/328-102-0x0000000140000000-0x0000000140110000-memory.dmp
memory/1256-75-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-78-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-82-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-84-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-83-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-85-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-86-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-79-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-88-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-89-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-87-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-73-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-66-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-90-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-65-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-96-0x0000000003A80000-0x0000000003A90000-memory.dmp
memory/1256-80-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-81-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-77-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-64-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/1256-76-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-74-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-72-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-67-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-71-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-70-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-68-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1256-69-0x0000000140000000-0x000000014010F000-memory.dmp
memory/1916-60-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp
memory/1916-63-0x00000000003A0000-0x00000000003A7000-memory.dmp
memory/1916-61-0x0000000140000000-0x000000014010F000-memory.dmp