Analysis
- max time kernel
150s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
26/11/2021, 09:29
General
- Target 899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb.dll
- Size 1.3MB
- Sample211126-lfxtbabefl
- SHA256 899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\aCPlmDujq\osk.exeC:\Users\Admin\AppData\Local\aCPlmDujq\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\iC8aDOS\ComputerDefaults.exeC:\Users\Admin\AppData\Local\iC8aDOS\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\uBBYj7ihL\recdisc.exeC:\Users\Admin\AppData\Local\uBBYj7ihL\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/516-168-0x000001E81D920000-0x000001E81D922000-memory.dmp
memory/516-170-0x000001E81D920000-0x000001E81D922000-memory.dmp
memory/516-164-0x00007FFDC40F0000-0x00007FFDC4239000-memory.dmp
memory/516-169-0x000001E81D920000-0x000001E81D922000-memory.dmp
memory/696-179-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
memory/696-180-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
memory/696-181-0x0000024CA6290000-0x0000024CA6292000-memory.dmp
memory/2276-159-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
memory/2276-158-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
memory/2276-157-0x000001ED670F0000-0x000001ED670F2000-memory.dmp
memory/2276-153-0x00007FFDC40B0000-0x00007FFDC423E000-memory.dmp
memory/2700-115-0x00007FFDC40F0000-0x00007FFDC4238000-memory.dmp
memory/2700-121-0x000001A9562F0000-0x000001A9562F7000-memory.dmp
memory/2700-120-0x000001A956300000-0x000001A956302000-memory.dmp
memory/2700-119-0x000001A956300000-0x000001A956302000-memory.dmp
memory/3020-130-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-148-0x00007FFDD2430000-0x00007FFDD2432000-memory.dmp
memory/3020-147-0x0000000000820000-0x0000000000822000-memory.dmp
memory/3020-146-0x00007FFDD22F5000-0x00007FFDD22F6000-memory.dmp
memory/3020-145-0x0000000000820000-0x0000000000822000-memory.dmp
memory/3020-144-0x0000000000820000-0x0000000000822000-memory.dmp
memory/3020-139-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-138-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-137-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-136-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-135-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-134-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-133-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-132-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-131-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-129-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-128-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-127-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-126-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-125-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-124-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-123-0x0000000140000000-0x0000000140148000-memory.dmp
memory/3020-122-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/3020-182-0x0000000000820000-0x0000000000822000-memory.dmp