Analysis
- max time kernel
0s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 01:58
General
- Target 736f4c09867897af390e3e0bf50a0b23.dll
- Size 3.5MB
- Sample240125-cdwnssdgf2
- SHA256 fee679a74d93c6adee409515fdf168e955e056dae2949cbf848a48e03a8ac97d
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\736f4c09867897af390e3e0bf50a0b23.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\I1dV\tabcal.exeC:\Users\Admin\AppData\Local\I1dV\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\4QvI\unregmp2.exeC:\Users\Admin\AppData\Local\4QvI\unregmp2.exe1⤵
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\ouTw\rdpinit.exeC:\Users\Admin\AppData\Local\ouTw\rdpinit.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VERSION.dll
VERSION.dll
unregmp2.exe
unregmp2.exe
HID.DLL
HID.DLL
tabcal.exe
tabcal.exe
dwmapi.dll
dwmapi.dll
rdpinit.exe
rdpinit.exe
Iydemppuyghrhln.lnk
VERSION.dll
dwmapi.dll
HID.DLL
memory/652-102-0x000001DCE2EC0000-0x000001DCE2EC7000-memory.dmp
memory/652-106-0x0000000140000000-0x000000014037B000-memory.dmp
memory/652-99-0x0000000140000000-0x000000014037B000-memory.dmp
memory/776-144-0x0000000140000000-0x000000014037B000-memory.dmp
memory/776-139-0x0000024F73960000-0x0000024F73967000-memory.dmp
memory/776-137-0x0000000140000000-0x000000014037B000-memory.dmp
memory/3560-25-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-50-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-27-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-28-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-31-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-33-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-35-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-34-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-36-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-38-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-39-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-37-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-40-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-32-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-30-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-42-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-44-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-49-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-52-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-53-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-54-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-56-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-57-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-59-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-60-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-62-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-61-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-58-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-63-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-65-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-66-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-64-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-70-0x0000000002270000-0x0000000002277000-memory.dmp
memory/3560-55-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-51-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-26-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-48-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-47-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-78-0x00007FF9413E0000-0x00007FF9413F0000-memory.dmp
memory/3560-46-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-45-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-43-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-41-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-29-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-6-0x00007FF93FD3A000-0x00007FF93FD3B000-memory.dmp
memory/3560-24-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-23-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-22-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-17-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-21-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-5-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/3560-9-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-20-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-19-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-18-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-16-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-15-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-14-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-13-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-12-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-10-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3560-11-0x0000000140000000-0x000000014037A000-memory.dmp
memory/3820-119-0x0000000140000000-0x000000014037B000-memory.dmp
memory/3820-125-0x0000000140000000-0x000000014037B000-memory.dmp
memory/3820-121-0x000001A377FD0000-0x000001A377FD7000-memory.dmp
memory/4752-8-0x0000000140000000-0x000000014037A000-memory.dmp
memory/4752-1-0x0000000140000000-0x000000014037A000-memory.dmp
memory/4752-2-0x0000022958F00000-0x0000022958F07000-memory.dmp
memory/4752-0-0x0000000140000000-0x000000014037A000-memory.dmp