Analysis
- max time kernel
162s - max time network
145s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
26/11/2021, 09:26
General
- Target 114c890f736efbfef6a5d5bfe69d10f3b98b5cf919b25536bff9dd7ba2738fc6.dll
- Size 1.5MB
- Sample211126-ld769sbecq
- SHA256 114c890f736efbfef6a5d5bfe69d10f3b98b5cf919b25536bff9dd7ba2738fc6
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\114c890f736efbfef6a5d5bfe69d10f3b98b5cf919b25536bff9dd7ba2738fc6.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\qJsNcyoy\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\qJsNcyoy\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\RB1\msconfig.exeC:\Users\Admin\AppData\Local\RB1\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\gzy1envO\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\gzy1envO\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/900-176-0x00007FF9EF7D0000-0x00007FF9EF95A000-memory.dmp
memory/900-180-0x0000013D3CC40000-0x0000013D3CC42000-memory.dmp
memory/900-181-0x0000013D3CC40000-0x0000013D3CC42000-memory.dmp
memory/900-182-0x0000013D3CC40000-0x0000013D3CC42000-memory.dmp
memory/3044-133-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-135-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-138-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-139-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-137-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-140-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-145-0x0000000000660000-0x0000000000662000-memory.dmp
memory/3044-146-0x0000000000660000-0x0000000000662000-memory.dmp
memory/3044-148-0x0000000000660000-0x0000000000662000-memory.dmp
memory/3044-147-0x00007FFA0B1E5000-0x00007FFA0B1E6000-memory.dmp
memory/3044-149-0x00007FFA0B320000-0x00007FFA0B322000-memory.dmp
memory/3044-183-0x0000000000660000-0x0000000000662000-memory.dmp
memory/3044-136-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-130-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-134-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-129-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-128-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-126-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-125-0x0000000000620000-0x0000000000621000-memory.dmp
memory/3044-127-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-132-0x0000000140000000-0x0000000140189000-memory.dmp
memory/3044-131-0x0000000140000000-0x0000000140189000-memory.dmp
memory/4016-124-0x000002820F7E0000-0x000002820F7E7000-memory.dmp
memory/4016-123-0x000002820F7F0000-0x000002820F7F2000-memory.dmp
memory/4016-122-0x000002820F7F0000-0x000002820F7F2000-memory.dmp
memory/4016-118-0x00007FF9FD2F0000-0x00007FF9FD479000-memory.dmp
memory/4456-169-0x0000020353550000-0x0000020353552000-memory.dmp
memory/4456-171-0x0000020353550000-0x0000020353552000-memory.dmp
memory/4456-170-0x0000020353550000-0x0000020353552000-memory.dmp
memory/4456-165-0x00007FF9EF7D0000-0x00007FF9EF960000-memory.dmp
memory/4484-160-0x000002177CEE0000-0x000002177CEE2000-memory.dmp
memory/4484-159-0x000002177CEE0000-0x000002177CEE2000-memory.dmp
memory/4484-158-0x000002177CEE0000-0x000002177CEE2000-memory.dmp
memory/4484-154-0x00007FF9FD2F0000-0x00007FF9FD47A000-memory.dmp