Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
26/01/2024, 22:07
General
- Target 78833dc80091e76f426f64b576358fef.dll
- Size 1.9MB
- Sample240126-116dhsfch6
- SHA256 c004c89e8e9190bf7629831fa4b9f1a6a90510777e4d233e119b0f4902f66222
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\78833dc80091e76f426f64b576358fef.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\EfSUafuH8\raserver.exeC:\Users\Admin\AppData\Local\EfSUafuH8\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\pkV\GamePanel.exeC:\Users\Admin\AppData\Local\pkV\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\3eOQ\SysResetErr.exeC:\Users\Admin\AppData\Local\3eOQ\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
DUI70.dll
SysResetErr.exe
WTSAPI32.dll
WTSAPI32.dll
raserver.exe
raserver.exe
GamePanel.exe
GamePanel.exe
dxgi.dll
dxgi.dll
dxgi.dll
Ocuuy.lnk
DUI70.dll
WTSAPI32.dll
dxgi.dll
memory/968-77-0x0000020AB6390000-0x0000020AB6397000-memory.dmp
memory/968-81-0x0000000140000000-0x00000001401F4000-memory.dmp
memory/968-75-0x0000000140000000-0x00000001401F4000-memory.dmp
memory/1612-112-0x000001E2A0B20000-0x000001E2A0B27000-memory.dmp
memory/3500-25-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-42-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-29-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-30-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-32-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-33-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-35-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-37-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-38-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-39-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-36-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-34-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-31-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-23-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-22-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-21-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-19-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-41-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-45-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-46-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-47-0x0000000003300000-0x0000000003307000-memory.dmp
memory/3500-44-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-54-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-55-0x00007FFD76F60000-0x00007FFD76F70000-memory.dmp
memory/3500-43-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-28-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-66-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-24-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-26-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-27-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-5-0x00007FFD765DA000-0x00007FFD765DB000-memory.dmp
memory/3500-20-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-18-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-17-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-16-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-15-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-4-0x00000000076F0000-0x00000000076F1000-memory.dmp
memory/3500-9-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-13-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-14-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-64-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-40-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-12-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-11-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-10-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/3500-7-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/4832-96-0x000001FE2A680000-0x000001FE2A687000-memory.dmp
memory/4952-8-0x0000000140000000-0x00000001401F3000-memory.dmp
memory/4952-1-0x000001FA89210000-0x000001FA89217000-memory.dmp
memory/4952-0-0x0000000140000000-0x00000001401F3000-memory.dmp