Analysis
- max time kernel
131s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/01/2024, 05:15
General
- Target 818f6364c18d61853f5e7875c46b41b7.dll
- Size 2.2MB
- Sample240130-fxwdxsaear
- SHA256 354581ef623c4841ef267fae935ea55b0aa622c1de1aec7c31d3fbfe05005e00
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\818f6364c18d61853f5e7875c46b41b7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\XSLR4F7mS\rdpinput.exeC:\Users\Admin\AppData\Local\XSLR4F7mS\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\x85\wlrmdr.exeC:\Users\Admin\AppData\Local\x85\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\swX7\sethc.exeC:\Users\Admin\AppData\Local\swX7\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WINSTA.dll
WINSTA.dll
rdpinput.exe
rdpinput.exe
OLEACC.dll
OLEACC.dll
sethc.exe
sethc.exe
DUI70.dll
DUI70.dll
wlrmdr.exe
wlrmdr.exe
Psfjn.lnk
WINSTA.dll
DUI70.dll
OLEACC.dll
memory/972-80-0x000001B0ECFB0000-0x000001B0ECFB7000-memory.dmp
memory/972-81-0x0000000140000000-0x0000000140239000-memory.dmp
memory/2280-0-0x0000017405EC0000-0x0000017405EC7000-memory.dmp
memory/2280-1-0x0000000140000000-0x0000000140237000-memory.dmp
memory/2280-7-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-37-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-32-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-48-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-38-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-69-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-71-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-59-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-47-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-46-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-45-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-42-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-40-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-49-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-51-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-12-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-11-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-10-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-8-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-9-0x00007FFF27BAA000-0x00007FFF27BAB000-memory.dmp
memory/3492-39-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-62-0x00007FFF28E80000-0x00007FFF28E90000-memory.dmp
memory/3492-36-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-35-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-50-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-44-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-43-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-6-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-33-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-52-0x0000000000D30000-0x0000000000D37000-memory.dmp
memory/3492-41-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-13-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-4-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/3492-34-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-27-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-23-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-31-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-30-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-29-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-28-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-26-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-25-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-24-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-22-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-21-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-19-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-20-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-16-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-15-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-14-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-18-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3492-17-0x0000000140000000-0x0000000140237000-memory.dmp
memory/3652-98-0x0000027E16AF0000-0x0000027E16AF7000-memory.dmp
memory/4692-115-0x000002114A210000-0x000002114A217000-memory.dmp