Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
26/01/2024, 10:54
General
- Target 772b68bf3048024e686be386fbfe5083.dll
- Size 652KB
- Sample240126-mzhzyadcej
- SHA256 7c62dc19058fca240cc5e8942a240f7691e6066aa3d59a51185ac3209e8f1409
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\772b68bf3048024e686be386fbfe5083.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ngA.cmd1⤵
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\PSg.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN "Kjaztdntfug" /TR "C:\Windows\system32\KzwGYeZ\FXSCOVER.exe" /SC minute /MO 60 /RL highest1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /Query /TN "Kjaztdntfug"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
88925.tmp
PSg.cmd
ngA.cmd
qnB45D.tmp
Tgnmvdx.lnk
WerFault.exe
memory/3436-18-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-15-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-21-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-20-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-31-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-25-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-19-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-32-0x00007FF9CBD80000-0x00007FF9CBD90000-memory.dmp
memory/3436-43-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-41-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-5-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-17-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-16-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-23-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-14-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-13-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-12-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-11-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-9-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-8-0x00007FF9CB3BA000-0x00007FF9CB3BB000-memory.dmp
memory/3436-7-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-3-0x0000000002070000-0x0000000002071000-memory.dmp
memory/3436-24-0x0000000000420000-0x0000000000427000-memory.dmp
memory/3436-22-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/3436-10-0x0000000140000000-0x00000001400A3000-memory.dmp
memory/4040-0-0x00007FF9BD360000-0x00007FF9BD403000-memory.dmp
memory/4040-6-0x00007FF9BD360000-0x00007FF9BD403000-memory.dmp
memory/4040-2-0x0000022E08030000-0x0000022E08037000-memory.dmp