Analysis
- max time kernel
7s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
15/01/2024, 02:18
General
- Target 5bdfd617e729e972d86964c8e7a75d93.dll
- Size 1.7MB
- Sample240115-cq92ysfebm
- SHA256 bb238db2a10c9180d4cc5082fe5c1c6250875a36097ce32993f1ef294eb271f9
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5bdfd617e729e972d86964c8e7a75d93.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\ruzVTg\mstsc.exeC:\Users\Admin\AppData\Local\ruzVTg\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Kt2JkG\wusa.exeC:\Users\Admin\AppData\Local\Kt2JkG\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\yhEGls\bdechangepin.exeC:\Users\Admin\AppData\Local\yhEGls\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WTSAPI32.dll
WTSAPI32.dll
wusa.exe
wusa.exe
Secur32.dll
Secur32.dll
mstsc.exe
mstsc.exe
DUI70.dll
DUI70.dll
bdechangepin.exe
bdechangepin.exe
Aqwbkkvq.lnk
WTSAPI32.dll
Secur32.dll
DUI70.dll
memory/2156-0-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/2156-7-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/2156-1-0x00000000012C0000-0x00000000012C7000-memory.dmp
memory/2576-93-0x00000170ACB80000-0x00000170ACB87000-memory.dmp
memory/2576-97-0x0000000140000000-0x00000001401A8000-memory.dmp
memory/2852-209-0x000001C51D550000-0x000001C51D560000-memory.dmp
memory/3404-12-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-15-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-26-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-24-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-25-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-36-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-37-0x00007FFB24420000-0x00007FFB24430000-memory.dmp
memory/3404-46-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-48-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-6-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-8-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-16-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-29-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-27-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-17-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-18-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-21-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-4-0x0000000008C40000-0x0000000008C41000-memory.dmp
memory/3404-23-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-22-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-9-0x00007FFB2280A000-0x00007FFB2280B000-memory.dmp
memory/3404-10-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-11-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-13-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-14-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-28-0x0000000002A60000-0x0000000002A67000-memory.dmp
memory/3404-19-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3404-20-0x0000000140000000-0x00000001401A7000-memory.dmp
memory/3564-80-0x0000000140000000-0x00000001401A8000-memory.dmp
memory/3564-74-0x00000224D7C10000-0x00000224D7C17000-memory.dmp
memory/3564-75-0x0000000140000000-0x00000001401A8000-memory.dmp
memory/4512-63-0x0000000140000000-0x00000001401ED000-memory.dmp
memory/4512-59-0x00000294EEB20000-0x00000294EEB27000-memory.dmp
memory/4512-57-0x0000000140000000-0x00000001401ED000-memory.dmp