Analysis
- max time kernel
148s - max time network
118s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
15/01/2024, 23:38
General
- Target 5e62ff260e54061981cf7a9e5210c1e6.dll
- Size 1.8MB
- Sample240115-3m72asaaa4
- SHA256 7f3de25031b25c99cb65054f50d4e4a33a2c6f324b28cf40ff6d551a8ce37618
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 9 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e62ff260e54061981cf7a9e5210c1e6.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\49IxYjrE\psr.exeC:\Users\Admin\AppData\Local\49IxYjrE\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\RLYCeT8G\sdclt.exeC:\Users\Admin\AppData\Local\RLYCeT8G\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Windows\system32\RDVGHelper.exeC:\Windows\system32\RDVGHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\q02D\RDVGHelper.exeC:\Users\Admin\AppData\Local\q02D\RDVGHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\FpXubk\isoburn.exeC:\Users\Admin\AppData\Local\FpXubk\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
OLEACC.dll
psr.exe
psr.exe
UxTheme.dll
isoburn.exe
SPP.dll
sdclt.exe
sdclt.exe
RDVGHelper.exe
WTSAPI32.dll
Tiizeasb.lnk
RDVGHelper.exe
WTSAPI32.dll
SPP.dll
UxTheme.dll
isoburn.exe
OLEACC.dll
psr.exe
UxTheme.dll
isoburn.exe
SPP.dll
sdclt.exe
RDVGHelper.exe
WTSAPI32.dll
memory/1220-39-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-38-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-33-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-32-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-42-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-43-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-44-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-45-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-41-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-31-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-30-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-48-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-50-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-51-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-52-0x0000000002510000-0x0000000002517000-memory.dmp
memory/1220-49-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-47-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-46-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-29-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-28-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-27-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-63-0x00000000774D0000-0x00000000774D2000-memory.dmp
memory/1220-60-0x0000000077371000-0x0000000077372000-memory.dmp
memory/1220-59-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-25-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-70-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-23-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-76-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-37-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-36-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-4-0x0000000077266000-0x0000000077267000-memory.dmp
memory/1220-40-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-5-0x0000000002530000-0x0000000002531000-memory.dmp
memory/1220-21-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-35-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-20-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-19-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-34-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-15-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-26-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-24-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-22-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-7-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-170-0x0000000077266000-0x0000000077267000-memory.dmp
memory/1220-14-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-9-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-10-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-11-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-12-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-13-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-16-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-17-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1220-18-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/1300-153-0x0000000000100000-0x0000000000107000-memory.dmp
memory/1752-91-0x00000000005A0000-0x00000000005A7000-memory.dmp
memory/2012-137-0x00000000001A0000-0x00000000001A7000-memory.dmp
memory/2252-8-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/2252-1-0x0000000140000000-0x00000001401CD000-memory.dmp
memory/2252-0-0x0000000000190000-0x0000000000197000-memory.dmp
memory/2684-112-0x0000000000290000-0x0000000000297000-memory.dmp