Analysis
- max time kernel
157s - max time network
144s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
26/11/2021, 09:26
General
- Target a35a441cebe6101f1b6c2bccc4ef43fb86e45374628763843f4992bcee41d58e.dll
- Size 1.6MB
- Sample211126-ld769sbecn
- SHA256 a35a441cebe6101f1b6c2bccc4ef43fb86e45374628763843f4992bcee41d58e
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a35a441cebe6101f1b6c2bccc4ef43fb86e45374628763843f4992bcee41d58e.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\1ykoIv9\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\1ykoIv9\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\2M5Z\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\2M5Z\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\jXj01\sethc.exeC:\Users\Admin\AppData\Local\jXj01\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/480-151-0x00007FFA3C710000-0x00007FFA3C8A0000-memory.dmp
memory/480-157-0x000002362FBE0000-0x000002362FBE2000-memory.dmp
memory/480-156-0x000002362FBE0000-0x000002362FBE2000-memory.dmp
memory/480-155-0x000002362FBE0000-0x000002362FBE2000-memory.dmp
memory/504-121-0x00000000008B0000-0x00000000008B7000-memory.dmp
memory/504-115-0x00007FFA3C710000-0x00007FFA3C89F000-memory.dmp
memory/504-120-0x00000000008C0000-0x00000000008C2000-memory.dmp
memory/504-119-0x00000000008C0000-0x00000000008C2000-memory.dmp
memory/1816-178-0x0000015CD7360000-0x0000015CD7362000-memory.dmp
memory/1816-177-0x0000015CD7360000-0x0000015CD7362000-memory.dmp
memory/1816-179-0x0000015CD7360000-0x0000015CD7362000-memory.dmp
memory/3024-130-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-131-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-146-0x00007FFA4AA00000-0x00007FFA4AA02000-memory.dmp
memory/3024-144-0x00007FFA4A8C5000-0x00007FFA4A8C6000-memory.dmp
memory/3024-143-0x0000000000D20000-0x0000000000D22000-memory.dmp
memory/3024-142-0x0000000000D20000-0x0000000000D22000-memory.dmp
memory/3024-137-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-136-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-135-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-134-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-133-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-122-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/3024-132-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-145-0x0000000000D20000-0x0000000000D22000-memory.dmp
memory/3024-127-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-124-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-123-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-125-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-126-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-129-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3024-128-0x0000000140000000-0x000000014018F000-memory.dmp
memory/3456-168-0x00000251C9520000-0x00000251C9522000-memory.dmp
memory/3456-167-0x00000251C9520000-0x00000251C9522000-memory.dmp
memory/3456-166-0x00000251C9520000-0x00000251C9522000-memory.dmp
memory/3456-162-0x00007FFA2F400000-0x00007FFA2F590000-memory.dmp