Analysis
- max time kernel
151s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
27/01/2024, 04:12
General
- Target 793df85f287f06c4764a229b404e0a7f.dll
- Size 660KB
- Sample240127-eskaeschg2
- SHA256 823691284d6b7786dee73b7315b3cd146eac4160d5f7fca663cab821b66698fa
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\793df85f287f06c4764a229b404e0a7f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\G25\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\G25\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\ObVqq\wscript.exeC:\Users\Admin\AppData\Local\ObVqq\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\V62s\AtBroker.exeC:\Users\Admin\AppData\Local\V62s\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SYSDM.CPL
SystemPropertiesDataExecutionPrevention.exe
VERSION.dll
wscript.exe
AtBroker.exe
UxTheme.dll
Btpzaqnqvnv.lnk
memory/1208-43-0x000002AFA8080000-0x000002AFA8087000-memory.dmp
memory/1208-48-0x00007FFD8F020000-0x00007FFD8F0C6000-memory.dmp
memory/1208-44-0x00007FFD8F020000-0x00007FFD8F0C6000-memory.dmp
memory/1576-60-0x00007FFD8F080000-0x00007FFD8F126000-memory.dmp
memory/1576-59-0x000002088DFB0000-0x000002088DFB7000-memory.dmp
memory/1576-64-0x00007FFD8F080000-0x00007FFD8F126000-memory.dmp
memory/3280-0-0x00007FFD9EC90000-0x00007FFD9ED35000-memory.dmp
memory/3280-36-0x00007FFD9EC90000-0x00007FFD9ED35000-memory.dmp
memory/3280-2-0x000002A7EDC80000-0x000002A7EDC87000-memory.dmp
memory/3552-10-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-11-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-24-0x00007FFDAD130000-0x00007FFDAD140000-memory.dmp
memory/3552-23-0x00007FFDAD140000-0x00007FFDAD150000-memory.dmp
memory/3552-22-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-12-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-15-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-14-0x00000000027B0000-0x00000000027B7000-memory.dmp
memory/3552-13-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-33-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-9-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-8-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-7-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-6-0x0000000140000000-0x00000001400A5000-memory.dmp
memory/3552-5-0x00007FFDAB1FA000-0x00007FFDAB1FB000-memory.dmp
memory/3552-3-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/3988-80-0x00007FFD8F080000-0x00007FFD8F126000-memory.dmp
memory/3988-76-0x0000018DBFE30000-0x0000018DBFE37000-memory.dmp