Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
17/01/2024, 12:26
General
- Target 629d2b1f7b0eb228fa69ff53bbc61604.dll
- Size 3.2MB
- Sample240117-pmfedsehfk
- SHA256 b09223c97f0da631b1e35c1ca73b8de4033edbca4752a01a8a89a78b36dd306b
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\629d2b1f7b0eb228fa69ff53bbc61604.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\KbAnk9j\msconfig.exeC:\Users\Admin\AppData\Local\KbAnk9j\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\Dgp\rstrui.exeC:\Users\Admin\AppData\Local\Dgp\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\80U\wermgr.exeC:\Users\Admin\AppData\Local\80U\wermgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wer.dll
wermgr.exe
SRCORE.dll
rstrui.exe
rstrui.exe
VERSION.dll
msconfig.exe
msconfig.exe
wer.dll
VERSION.dll
Gmfoo.lnk
SRCORE.dll
wer.dll
wermgr.exe
SRCORE.dll
rstrui.exe
VERSION.dll
msconfig.exe
memory/856-144-0x00000000000F0000-0x00000000000F7000-memory.dmp
memory/1196-23-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-55-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-24-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-4-0x0000000077AB6000-0x0000000077AB7000-memory.dmp
memory/1196-26-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-27-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-30-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-29-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-28-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-36-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-37-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-35-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-34-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-33-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-32-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-31-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-39-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-40-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-38-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-41-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-43-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-42-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-44-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-45-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-50-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-51-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-49-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-48-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-47-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-46-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-52-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-53-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-54-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-56-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-57-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-25-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-58-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-62-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-63-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-61-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-60-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-59-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-65-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-64-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-70-0x0000000002B10000-0x0000000002B17000-memory.dmp
memory/1196-80-0x0000000077D20000-0x0000000077D22000-memory.dmp
memory/1196-79-0x0000000077BC1000-0x0000000077BC2000-memory.dmp
memory/1196-22-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-15-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-16-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-17-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-5-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1196-18-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-19-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-21-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-20-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-14-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-7-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-12-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-13-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-11-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-10-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-9-0x0000000140000000-0x000000014033E000-memory.dmp
memory/1196-164-0x0000000077AB6000-0x0000000077AB7000-memory.dmp
memory/2124-107-0x0000000001B60000-0x0000000001B67000-memory.dmp
memory/2884-125-0x0000000000230000-0x0000000000237000-memory.dmp
memory/3064-8-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3064-0-0x0000000000110000-0x0000000000117000-memory.dmp
memory/3064-1-0x0000000140000000-0x000000014033E000-memory.dmp