Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
19/01/2024, 07:50
General
- Target 6714db2df8a6f6b5c50d59629ec34c6c.dll
- Size 3.2MB
- Sample240119-jprybaacf5
- SHA256 d86ef2b5b3a29c907febf6d15d8f3fa781e1d5314549fed66df51d00db694818
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6714db2df8a6f6b5c50d59629ec34c6c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\1LYvp\slui.exeC:\Users\Admin\AppData\Local\1LYvp\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\xTgeUD\SoundRecorder.exeC:\Users\Admin\AppData\Local\xTgeUD\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\0ShrJ\rdrleakdiag.exeC:\Users\Admin\AppData\Local\0ShrJ\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wer.dll
WINBRAND.dll
slui.exe
slui.exe
WINMM.dll
WINBRAND.dll
Yiudzqwx.lnk
wer.dll
WINMM.dll
rdrleakdiag.exe
wer.dll
WINBRAND.dll
slui.exe
SoundRecorder.exe
WINMM.dll
memory/1360-49-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-56-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-21-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-17-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-25-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-26-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-27-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-29-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-30-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-31-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-32-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-28-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-34-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-35-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-38-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-39-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-40-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-41-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-36-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-42-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-37-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-43-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-45-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-44-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-46-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-47-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-48-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-4-0x00000000779A6000-0x00000000779A7000-memory.dmp
memory/1360-52-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-53-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-51-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-50-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-54-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-55-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-33-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-22-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-57-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-59-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-61-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-62-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-60-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-64-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-63-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-65-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-66-0x0000000002590000-0x0000000002597000-memory.dmp
memory/1360-58-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-74-0x0000000077AB1000-0x0000000077AB2000-memory.dmp
memory/1360-77-0x0000000077C10000-0x0000000077C12000-memory.dmp
memory/1360-23-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-24-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-18-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-5-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/1360-7-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-9-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-10-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-20-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-19-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-16-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-14-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-15-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-157-0x00000000779A6000-0x00000000779A7000-memory.dmp
memory/1360-13-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-12-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1360-11-0x0000000140000000-0x0000000140331000-memory.dmp
memory/1864-118-0x0000000000100000-0x0000000000107000-memory.dmp
memory/2168-8-0x0000000140000000-0x0000000140331000-memory.dmp
memory/2168-1-0x0000000140000000-0x0000000140331000-memory.dmp
memory/2168-0-0x0000000000110000-0x0000000000117000-memory.dmp
memory/2828-135-0x00000000000F0000-0x00000000000F7000-memory.dmp
memory/3000-98-0x0000000000190000-0x0000000000197000-memory.dmp