Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/09/2021, 07:29
General
- Target 242ceec6f5000a48618d138fa52d20a9350a0fb36f6a202ef098d15656376c79.dll
- Size 2.0MB
- Sample210929-ja9jtaebhp
- SHA256 242ceec6f5000a48618d138fa52d20a9350a0fb36f6a202ef098d15656376c79
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\242ceec6f5000a48618d138fa52d20a9350a0fb36f6a202ef098d15656376c79.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\7XUD8mzrm\Narrator.exeC:\Users\Admin\AppData\Local\7XUD8mzrm\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\wgNIr0\msra.exeC:\Users\Admin\AppData\Local\wgNIr0\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\3RIpO\mfpmp.exeC:\Users\Admin\AppData\Local\3RIpO\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\oLA3FzR\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\oLA3FzR\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/60-171-0x0000000140000000-0x0000000140200000-memory.dmp
memory/364-182-0x0000000140000000-0x0000000140201000-memory.dmp
memory/2392-115-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/2392-119-0x0000016C372C0000-0x0000016C372C7000-memory.dmp
memory/3064-144-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-153-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-136-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-137-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-138-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-139-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-140-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-141-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-142-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-143-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-134-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-145-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-146-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-147-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-148-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-149-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-150-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-151-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-152-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-135-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-154-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-155-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-163-0x00007FFFA2014560-0x00007FFFA2015560-memory.dmp
memory/3064-165-0x00007FFFA2150000-0x00007FFFA2152000-memory.dmp
memory/3064-121-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-133-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-132-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-131-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-130-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-125-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-129-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-128-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-127-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-126-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-124-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-120-0x0000000000930000-0x0000000000931000-memory.dmp
memory/3064-123-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3064-122-0x0000000140000000-0x00000001401FF000-memory.dmp