899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb
899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb.dll
1MB
26-11-2021 09:32
cd87697a9e2bdfac82d9b7154c3105ce
963e78487647a3b7199211154b8fe7f6babe6bbb
899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb
Filter: none
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Dridex Shellcode
Description
Detects Dridex Payload shellcode injected in Explorer process.
Tags
Reported IOCs
resource yara_rule behavioral2/memory/3020-122-0x00000000005E0000-0x00000000005E1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXEosk.exeComputerDefaults.exerecdisc.exe
Reported IOCs
pid process 2276 osk.exe 516 ComputerDefaults.exe 696 recdisc.exe -
Loads dropped DLLosk.exeComputerDefaults.exerecdisc.exe
Reported IOCs
pid process 2276 osk.exe 516 ComputerDefaults.exe 696 recdisc.exe -
Adds Run key to start application
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Slqggwbvaxk = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Extensions\\65CvtYODB2G\\ComputerDefaults.exe" -
Checks whether UAC is enabledrundll32.exeosk.exeComputerDefaults.exerecdisc.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA osk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ComputerDefaults.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA recdisc.exe -
Modifies registry class
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Suspicious behavior: EnumeratesProcessesrundll32.exeosk.exe
Reported IOCs
pid process 2700 rundll32.exe 2700 rundll32.exe 2700 rundll32.exe 2700 rundll32.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 2276 osk.exe 2276 osk.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam
Reported IOCs
pid process 3020 -
Suspicious use of AdjustPrivilegeToken
Reported IOCs
description pid process Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 -
Suspicious use of WriteProcessMemory
Reported IOCs
description pid process target process PID 3020 wrote to memory of 588 3020 osk.exe PID 3020 wrote to memory of 588 3020 osk.exe PID 3020 wrote to memory of 2276 3020 osk.exe PID 3020 wrote to memory of 2276 3020 osk.exe PID 3020 wrote to memory of 3260 3020 ComputerDefaults.exe PID 3020 wrote to memory of 3260 3020 ComputerDefaults.exe PID 3020 wrote to memory of 516 3020 ComputerDefaults.exe PID 3020 wrote to memory of 516 3020 ComputerDefaults.exe PID 3020 wrote to memory of 1032 3020 recdisc.exe PID 3020 wrote to memory of 1032 3020 recdisc.exe PID 3020 wrote to memory of 696 3020 recdisc.exe PID 3020 wrote to memory of 696 3020 recdisc.exe
-
C:\Windows\system32\rundll32.exePID:2700rundll32.exe C:\Users\Admin\AppData\Local\Temp\899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb.dll,#1Checks whether UAC is enabledSuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exePID:588C:\Windows\system32\osk.exe
-
C:\Users\Admin\AppData\Local\aCPlmDujq\osk.exePID:2276C:\Users\Admin\AppData\Local\aCPlmDujq\osk.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabledSuspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ComputerDefaults.exePID:3260C:\Windows\system32\ComputerDefaults.exe
-
C:\Users\Admin\AppData\Local\iC8aDOS\ComputerDefaults.exePID:516C:\Users\Admin\AppData\Local\iC8aDOS\ComputerDefaults.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabled
-
C:\Windows\system32\recdisc.exePID:1032C:\Windows\system32\recdisc.exe
-
C:\Users\Admin\AppData\Local\uBBYj7ihL\recdisc.exePID:696C:\Users\Admin\AppData\Local\uBBYj7ihL\recdisc.exeExecutes dropped EXELoads dropped DLLChecks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\aCPlmDujq\DUI70.dll
MD5c12ea6d49940d51ddd04ddbeca84e83f
SHA1a747d144eda80d7e817e8cf7cf5d0e2e29b9bba8
SHA256e137e95c010bebd7a27f9d0e566b4df9a440f8e21520dbdebd5b0ac9c570e253
SHA51225b8faf92910db077f460c2900c01065ab02d14ea5302ba1582083ca00aced7206e8bc04fd911c074dee2924cdd520eb01b22cf8fbc03f40066e2a8bfe29b393
-
C:\Users\Admin\AppData\Local\aCPlmDujq\osk.exe
MD54a614350289f2f92c6d7c5caccc09eff
SHA155e6807f31f66120e4798e37a8fb26e583ce1c81
SHA256f259aa7bfb7f18f981d0a08888942f5027766cdcf4d4d60d2540d5eda048fd68
SHA512ddf8fdc5b186ab9a15fa15310356d48cfbe1948fda0f0e624b1a429be11f406e5e3ce1924f48bbb9a9d14ede34a20c55c3e88f1f640e9d7d21f39bfad3c21dfc
-
C:\Users\Admin\AppData\Local\iC8aDOS\ComputerDefaults.exe
MD556d03e4218082266a9cdd8600537d891
SHA1c153719f971dcee8f6985d7c79f64fc88dd8663c
SHA256210d5714497505022aa068167f7ed5bb826abcf53cfe741c9860a2c8dce3f54a
SHA512f2c64a4dbab789635bf97b3d615fcc96dfe8c4094b67a464eb34bc84501eb7648e7fa692971e917c1ebfac0548187721ecc552aaad35767f8a40846d922613d3
-
C:\Users\Admin\AppData\Local\iC8aDOS\appwiz.cpl
MD5d7a03e7e49670fd138157c089cc871c2
SHA13b5515538ed900550e160ded4c1e80dbc1527d79
SHA256c47c0f5f1d167c0655a05a7b8a2c9d93ff81e177dc2d03cdda7a483f60cf44af
SHA512e302a0d6cb31b272cd7b18ef0e7ca167a270cc1449a6056490b12c6a05ddf8e1fb5fbcd28853fb6fa30b91d51cb4ea5ba7abe8dfb98a890fae8ff5f1a0845ff3
-
C:\Users\Admin\AppData\Local\uBBYj7ihL\ReAgent.dll
MD57a8614608bbb17ef1e75a4bc73e7a37d
SHA1bea99990d113812d6034b3ab2c2cd6c536b75ddc
SHA256526445a9fafcca40460fd00989ae8b9b76c79c8d33ade9d0e176b31f699bd3eb
SHA512f8e236744ab5fc28b01194037e996b0a3fdbf43b07e51370d05de131af4f2dd6c4b92fc319e4b0718112b8e00bccf7d6e2f5a160c82858cd70ffd81d6b25037a
-
C:\Users\Admin\AppData\Local\uBBYj7ihL\recdisc.exe
MD5d1028c10d2c261d3470df8ff6347981b
SHA104a99956e99b8dbed380df60e0812e92685b6ca9
SHA256063e57b52257fda4cfa15c98a84f3461a9fb1c9d39e6ab55eae41a793a4d852b
SHA51280922e37cdfe69d5390f8a5bf8f0aab98407d40549c8972c33c6b9ef15b38962887ef4637c81c248ba7ee649bfe20f318358359140d879f7e2820e135e11a9c3
-
\Users\Admin\AppData\Local\aCPlmDujq\DUI70.dll
MD5c12ea6d49940d51ddd04ddbeca84e83f
SHA1a747d144eda80d7e817e8cf7cf5d0e2e29b9bba8
SHA256e137e95c010bebd7a27f9d0e566b4df9a440f8e21520dbdebd5b0ac9c570e253
SHA51225b8faf92910db077f460c2900c01065ab02d14ea5302ba1582083ca00aced7206e8bc04fd911c074dee2924cdd520eb01b22cf8fbc03f40066e2a8bfe29b393
-
\Users\Admin\AppData\Local\iC8aDOS\appwiz.cpl
MD5d7a03e7e49670fd138157c089cc871c2
SHA13b5515538ed900550e160ded4c1e80dbc1527d79
SHA256c47c0f5f1d167c0655a05a7b8a2c9d93ff81e177dc2d03cdda7a483f60cf44af
SHA512e302a0d6cb31b272cd7b18ef0e7ca167a270cc1449a6056490b12c6a05ddf8e1fb5fbcd28853fb6fa30b91d51cb4ea5ba7abe8dfb98a890fae8ff5f1a0845ff3
-
\Users\Admin\AppData\Local\uBBYj7ihL\ReAgent.dll
MD57a8614608bbb17ef1e75a4bc73e7a37d
SHA1bea99990d113812d6034b3ab2c2cd6c536b75ddc
SHA256526445a9fafcca40460fd00989ae8b9b76c79c8d33ade9d0e176b31f699bd3eb
SHA512f8e236744ab5fc28b01194037e996b0a3fdbf43b07e51370d05de131af4f2dd6c4b92fc319e4b0718112b8e00bccf7d6e2f5a160c82858cd70ffd81d6b25037a
-
memory/516-164-0x00007FFDC40F0000-0x00007FFDC4239000-memory.dmp
-
memory/516-160-0x0000000000000000-mapping.dmp
-
memory/516-168-0x000001E81D920000-0x000001E81D922000-memory.dmp
-
memory/516-170-0x000001E81D920000-0x000001E81D922000-memory.dmp
-
memory/516-169-0x000001E81D920000-0x000001E81D922000-memory.dmp
-
memory/696-171-0x0000000000000000-mapping.dmp
-
memory/696-179-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
-
memory/696-180-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
-
memory/696-181-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
-
memory/2276-157-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
-
memory/2276-153-0x00007FFDC40B0000-0x00007FFDC423E000-memory.dmp
-
memory/2276-158-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
-
memory/2276-159-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
-
memory/2276-149-0x0000000000000000-mapping.dmp
-
memory/2700-115-0x00007FFDC40F0000-0x00007FFDC4238000-memory.dmp
-
memory/2700-121-0x000001A9562F0000-0x000001A9562F7000-memory.dmp
-
memory/2700-120-0x000001A956300000-0x000001A956302000-memory.dmp
-
memory/2700-119-0x000001A956300000-0x000001A956302000-memory.dmp
-
memory/3020-137-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-148-0x00007FFDD2430000-0x00007FFDD2432000-memory.dmp
-
memory/3020-146-0x00007FFDD22F5000-0x00007FFDD22F6000-memory.dmp
-
memory/3020-145-0x0000000000820000-0x0000000000822000-memory.dmp
-
memory/3020-147-0x0000000000820000-0x0000000000822000-memory.dmp
-
memory/3020-144-0x0000000000820000-0x0000000000822000-memory.dmp
-
memory/3020-139-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-138-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-136-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-135-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-134-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-182-0x0000000000820000-0x0000000000822000-memory.dmp
-
memory/3020-133-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-132-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-131-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-130-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-129-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-128-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-127-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-126-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-125-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-123-0x0000000140000000-0x0000000140148000-memory.dmp
-
memory/3020-122-0x00000000005E0000-0x00000000005E1000-memory.dmp
-
memory/3020-124-0x0000000140000000-0x0000000140148000-memory.dmp