dridex | 4d21115441459063cf8403f94d3bb37201666be30622cb2cb4e2ffb32827192f

General

Target

Results12232021.xls
Size

414KB
MD5

8d1d1df2277e8730eee7de7fe28f60e1
SHA1

773b3ff48428bdacf2afeb7fc9fd1261a2e0591c
SHA256

4d21115441459063cf8403f94d3bb37201666be30622cb2cb4e2ffb32827192f
SHA512

5f2f3d4b9295171dbbf246e2e6e23d07fa189bc7e3681ffd9c2778e3fef99621bf8f3b0a4c1d70061d6e06ec27f2c38151ccb4ba83b111bfe8051ca045834b76

Score

10^/10

dridex 22201 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.91.122.102:443

85.10.248.28:593

185.4.135.27:5228

80.211.3.13:8116

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WMIC.exemshta.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	576	1636	WMIC.exe	EXCEL.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	960	mshta.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	960	regsvr32.exe

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1688-65-0x000000006BB80000-0x000000006BC0C000-memory.dmp	dridex_ldr

Blocklisted process makes network request 2 IoCs

Processes:

mshta.exe

flow pid process

5 572 mshta.exe
7 572 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1688 regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	pid	process
5	572	mshta.exe
7	572	mshta.exe

pid	process
1688	regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1636 EXCEL.EXE

pid	process
1636	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	576	WMIC.exe
Token: SeSecurityPrivilege	576	WMIC.exe
Token: SeTakeOwnershipPrivilege	576	WMIC.exe
Token: SeLoadDriverPrivilege	576	WMIC.exe
Token: SeSystemProfilePrivilege	576	WMIC.exe
Token: SeSystemtimePrivilege	576	WMIC.exe
Token: SeProfSingleProcessPrivilege	576	WMIC.exe
Token: SeIncBasePriorityPrivilege	576	WMIC.exe
Token: SeCreatePagefilePrivilege	576	WMIC.exe
Token: SeBackupPrivilege	576	WMIC.exe
Token: SeRestorePrivilege	576	WMIC.exe
Token: SeShutdownPrivilege	576	WMIC.exe
Token: SeDebugPrivilege	576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	576	WMIC.exe
Token: SeRemoteShutdownPrivilege	576	WMIC.exe
Token: SeUndockPrivilege	576	WMIC.exe
Token: SeManageVolumePrivilege	576	WMIC.exe
Token: 33	576	WMIC.exe
Token: 34	576	WMIC.exe
Token: 35	576	WMIC.exe
Token: SeIncreaseQuotaPrivilege	576	WMIC.exe
Token: SeSecurityPrivilege	576	WMIC.exe
Token: SeTakeOwnershipPrivilege	576	WMIC.exe
Token: SeLoadDriverPrivilege	576	WMIC.exe
Token: SeSystemProfilePrivilege	576	WMIC.exe
Token: SeSystemtimePrivilege	576	WMIC.exe
Token: SeProfSingleProcessPrivilege	576	WMIC.exe
Token: SeIncBasePriorityPrivilege	576	WMIC.exe
Token: SeCreatePagefilePrivilege	576	WMIC.exe
Token: SeBackupPrivilege	576	WMIC.exe
Token: SeRestorePrivilege	576	WMIC.exe
Token: SeShutdownPrivilege	576	WMIC.exe
Token: SeDebugPrivilege	576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	576	WMIC.exe
Token: SeRemoteShutdownPrivilege	576	WMIC.exe
Token: SeUndockPrivilege	576	WMIC.exe
Token: SeManageVolumePrivilege	576	WMIC.exe
Token: 33	576	WMIC.exe
Token: 34	576	WMIC.exe
Token: 35	576	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1732	wmic.exe
Token: SeSecurityPrivilege	1732	wmic.exe
Token: SeTakeOwnershipPrivilege	1732	wmic.exe
Token: SeLoadDriverPrivilege	1732	wmic.exe
Token: SeSystemProfilePrivilege	1732	wmic.exe
Token: SeSystemtimePrivilege	1732	wmic.exe
Token: SeProfSingleProcessPrivilege	1732	wmic.exe
Token: SeIncBasePriorityPrivilege	1732	wmic.exe
Token: SeCreatePagefilePrivilege	1732	wmic.exe
Token: SeBackupPrivilege	1732	wmic.exe
Token: SeRestorePrivilege	1732	wmic.exe
Token: SeShutdownPrivilege	1732	wmic.exe
Token: SeDebugPrivilege	1732	wmic.exe
Token: SeSystemEnvironmentPrivilege	1732	wmic.exe
Token: SeRemoteShutdownPrivilege	1732	wmic.exe
Token: SeUndockPrivilege	1732	wmic.exe
Token: SeManageVolumePrivilege	1732	wmic.exe
Token: 33	1732	wmic.exe
Token: 34	1732	wmic.exe
Token: 35	1732	wmic.exe
Token: SeIncreaseQuotaPrivilege	1732	wmic.exe
Token: SeSecurityPrivilege	1732	wmic.exe
Token: SeTakeOwnershipPrivilege	1732	wmic.exe
Token: SeLoadDriverPrivilege	1732	wmic.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

EXCEL.EXE

pid process

1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE
1636 EXCEL.EXE

pid	process
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE
1636	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

EXCEL.EXEmshta.exeregsvr32.exe

description	pid	process	target process
PID 1636 wrote to memory of 576	1636	EXCEL.EXE	WMIC.exe
PID 1636 wrote to memory of 576	1636	EXCEL.EXE	WMIC.exe
PID 1636 wrote to memory of 576	1636	EXCEL.EXE	WMIC.exe
PID 1636 wrote to memory of 576	1636	EXCEL.EXE	WMIC.exe
PID 572 wrote to memory of 1732	572	mshta.exe	wmic.exe
PID 572 wrote to memory of 1732	572	mshta.exe	wmic.exe
PID 572 wrote to memory of 1732	572	mshta.exe	wmic.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1688	1724	regsvr32.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Results12232021.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" process call create "mshta.exe C:\ProgramData\NxeBChwsIhYFkIhhSsLtP.rtf"
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\mshta.exe
mshta.exe C:\ProgramData\NxeBChwsIhYFkIhhSsLtP.rtf
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\System32\Wbem\wmic.exe
wmic process call create "regsvr32.exe -s C:\\ProgramData\fvfnigger.bin"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s C:\\ProgramData\fvfnigger.bin
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\regsvr32.exe
-s C:\\ProgramData\fvfnigger.bin
2⤵
- Loads dropped DLL
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NxeBChwsIhYFkIhhSsLtP.rtf
MD5
ac47648ef54852865cc2096c3c511d68

SHA1
f9fdecd0f6f81f6e721b638217b9340409c76987

SHA256
50d220962236f5b89192f5a4c388b2aa60a910df8d4d7f0c014e88e64bafcf6d

SHA512
e6f1abf1dde8a753cf99281d66331ebd56efeaf3b5b5f7c86b7eb921ca40fc37890c377e3edbdc032932620c50dfc9fb46d34906a15726c1523fa349db391794

Download Submit
C:\ProgramData\fvfnigger.bin
MD5
d05719d3327d0a8d4fdf1735c88732fe

SHA1
1f6e535b5b90f10fefd2b6667767962066a79ca9

SHA256
5a6318fd453ef307f504536334e4b91b47b618e34cb669e94e4f987b2fbef8c1

SHA512
6ca3aa60526ba613c0322b69caea90f9fe5b19dce63cfbd44d737a3c570110e35442698aa10beecca50047fae444230e3491a10afd99613d09d29413c16ec96a

Download Submit
\ProgramData\fvfnigger.bin
MD5
d05719d3327d0a8d4fdf1735c88732fe

SHA1
1f6e535b5b90f10fefd2b6667767962066a79ca9

SHA256
5a6318fd453ef307f504536334e4b91b47b618e34cb669e94e4f987b2fbef8c1

SHA512
6ca3aa60526ba613c0322b69caea90f9fe5b19dce63cfbd44d737a3c570110e35442698aa10beecca50047fae444230e3491a10afd99613d09d29413c16ec96a

Download Submit
memory/576-57-0x0000000000000000-mapping.dmp

Download
memory/1636-54-0x000000002F761000-0x000000002F764000-memory.dmp

Filesize
12KB

Download
memory/1636-55-0x0000000070DC1000-0x0000000070DC3000-memory.dmp

Filesize
8KB

Download
memory/1636-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1636-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1688-63-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1688-62-0x0000000000000000-mapping.dmp

Download
memory/1688-65-0x000000006BB80000-0x000000006BC0C000-memory.dmp

Filesize
560KB

Download
memory/1688-67-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1724-60-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1732-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads