Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
17/01/2024, 06:19
General
- Target 61f2627485987b4054ff97050f0dfe2b.dll
- Size 964KB
- Sample240117-g3a6lsaack
- SHA256 771e168408b17e5f7ae16bd3a878820d0e0a844f25d549507b6d2b9c8ed0c9e2
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61f2627485987b4054ff97050f0dfe2b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\XiXy\consent.exeC:\Users\Admin\AppData\Local\XiXy\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\ohJDS\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\ohJDS\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\BZYdLu\DWWIN.EXEC:\Users\Admin\AppData\Local\BZYdLu\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\a50O\DWWIN.EXEC:\Users\Admin\AppData\Local\a50O\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DWWIN.EXE
wer.dll
consent.exe
DWWIN.EXE
wer.dll
wer.dll
dxgi.dll
dxgiadaptercache.exe
Iydemppuyghrhln.lnk
memory/1344-67-0x00007FFC7A080000-0x00007FFC7A173000-memory.dmp
memory/1344-69-0x000002536B6A0000-0x000002536B6A7000-memory.dmp
memory/1344-72-0x00007FFC7A080000-0x00007FFC7A173000-memory.dmp
memory/1656-84-0x000001459A790000-0x000001459A797000-memory.dmp
memory/1656-88-0x00007FFC7A080000-0x00007FFC7A173000-memory.dmp
memory/3292-36-0x00007FFC7A230000-0x00007FFC7A321000-memory.dmp
memory/3292-1-0x00007FFC7A230000-0x00007FFC7A321000-memory.dmp
memory/3292-0-0x0000019EF07C0000-0x0000019EF07C7000-memory.dmp
memory/3420-12-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-9-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-24-0x00007FFC88970000-0x00007FFC88980000-memory.dmp
memory/3420-14-0x0000000002430000-0x0000000002437000-memory.dmp
memory/3420-15-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-22-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-3-0x0000000002760000-0x0000000002761000-memory.dmp
memory/3420-6-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-23-0x00007FFC88980000-0x00007FFC88990000-memory.dmp
memory/3420-13-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-7-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-11-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-10-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-33-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3420-8-0x00007FFC877DA000-0x00007FFC877DB000-memory.dmp
memory/3420-5-0x0000000140000000-0x00000001400F1000-memory.dmp
memory/3620-51-0x00007FFC7A080000-0x00007FFC7A172000-memory.dmp
memory/3620-53-0x0000019F6C730000-0x0000019F6C737000-memory.dmp
memory/3620-56-0x00007FFC7A080000-0x00007FFC7A172000-memory.dmp