Analysis
- max time kernel
151s - max time network
154s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
28/09/2021, 09:27
General
- Target e68f928700b4296f2c389892bb68dfd844f5344d773af12245dae587e2e42257.dll
- Size 1.1MB
- Sample210928-lesg7sbeep
- SHA256 e68f928700b4296f2c389892bb68dfd844f5344d773af12245dae587e2e42257
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Payload 2 IoCs
Detects Dridex x64 core DLL in memory.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e68f928700b4296f2c389892bb68dfd844f5344d773af12245dae587e2e42257.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\Bg1V\SppExtComObj.ExeC:\Users\Admin\AppData\Local\Bg1V\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\q47tCl\GamePanel.exeC:\Users\Admin\AppData\Local\q47tCl\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\A1R6c\sethc.exeC:\Users\Admin\AppData\Local\A1R6c\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2392-115-0x0000000140000000-0x000000014010E000-memory.dmp
memory/2392-120-0x0000016C35AD0000-0x0000016C35AD7000-memory.dmp
memory/2512-162-0x0000000140000000-0x000000014010F000-memory.dmp
memory/3064-131-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-157-0x00007FFFA2014320-0x00007FFFA2015320-memory.dmp
memory/3064-137-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-138-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-139-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-140-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-141-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-142-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-143-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-144-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-145-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-146-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-147-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-122-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-156-0x00007FFFA2044320-0x00007FFFA2045320-memory.dmp
memory/3064-136-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-135-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-134-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-133-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-132-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-130-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-129-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-128-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-127-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-126-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-125-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-124-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-123-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3064-121-0x0000000000930000-0x0000000000931000-memory.dmp