Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/01/2024, 16:40
General
- Target 605ce935be49961234c42d733123c29a.dll
- Size 764KB
- Sample240116-t6h2vaehfm
- SHA256 0ed1a2100465042ad24cf6e257975add8949612ac5fe0a5349b03f6924a55e81
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\605ce935be49961234c42d733123c29a.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\Dx8jiWXF\GamePanel.exeC:\Users\Admin\AppData\Local\Dx8jiWXF\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\gsOXO8\ie4uinit.exeC:\Users\Admin\AppData\Local\gsOXO8\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\janTOO\upfc.exeC:\Users\Admin\AppData\Local\janTOO\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
GamePanel.exe
UxTheme.dll
VERSION.dll
ie4uinit.exe
XmlLite.dll
upfc.exe
Dvizybqqo.lnk
memory/376-53-0x0000000140000000-0x00000001400C0000-memory.dmp
memory/376-54-0x0000020157FF0000-0x0000020157FF7000-memory.dmp
memory/376-59-0x0000000140000000-0x00000001400C0000-memory.dmp
memory/568-90-0x000001C317720000-0x000001C317727000-memory.dmp
memory/568-95-0x0000000140000000-0x00000001400C0000-memory.dmp
memory/808-72-0x0000025AC81F0000-0x0000025AC81F7000-memory.dmp
memory/808-73-0x0000025AC8060000-0x0000025AC8120000-memory.dmp
memory/808-78-0x0000025AC8060000-0x0000025AC8120000-memory.dmp
memory/1224-1-0x0000000000660000-0x0000000000667000-memory.dmp
memory/1224-46-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/1224-0-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-13-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-18-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-21-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-24-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-27-0x00000000005F0000-0x00000000005F7000-memory.dmp
memory/3304-25-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-33-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-34-0x00007FF995D70000-0x00007FF995D80000-memory.dmp
memory/3304-43-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-22-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-20-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-17-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-19-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-23-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-16-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-15-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-14-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-12-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-11-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-10-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-9-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-8-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-7-0x0000000140000000-0x00000001400BF000-memory.dmp
memory/3304-4-0x0000000001F80000-0x0000000001F81000-memory.dmp
memory/3304-5-0x00007FF99457A000-0x00007FF99457B000-memory.dmp