Analysis
- max time kernel
151s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/01/2024, 04:39
General
- Target 837792f925aca842eba981ebc7aff9a1.dll
- Size 2.2MB
- Sample240131-e99awabgc7
- SHA256 3806ec3c6ae591fb47c6b48f5dbfaf45d7500d6efb12c07311ecdc5e9c9d514d
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\837792f925aca842eba981ebc7aff9a1.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Users\Admin\AppData\Local\4cnzpoY\quickassist.exeC:\Users\Admin\AppData\Local\4cnzpoY\quickassist.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\3J8wl4c\MusNotificationUx.exeC:\Users\Admin\AppData\Local\3J8wl4c\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\3ZobJ\isoburn.exeC:\Users\Admin\AppData\Local\3ZobJ\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MusNotificationUx.exe
XmlLite.dll
UxTheme.dll
isoburn.exe
UxTheme.dll
quickassist.exe
Btpzaqnqvnv.lnk
memory/1008-111-0x0000026180B40000-0x0000026180B47000-memory.dmp
memory/3480-36-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-41-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-16-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-18-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-19-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-20-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-17-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-22-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-23-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-24-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-25-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-26-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-21-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-27-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-28-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-29-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-30-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-33-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-32-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-31-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-34-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-35-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-4-0x0000000001350000-0x0000000001351000-memory.dmp
memory/3480-37-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-38-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-39-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-40-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-15-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-42-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-43-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-44-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-45-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-46-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-48-0x0000000001310000-0x0000000001317000-memory.dmp
memory/3480-47-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-55-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-58-0x00007FFE93140000-0x00007FFE93150000-memory.dmp
memory/3480-65-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-67-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-14-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-13-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-6-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-9-0x00007FFE914BA000-0x00007FFE914BB000-memory.dmp
memory/3480-8-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-10-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-11-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3480-12-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3904-7-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3904-1-0x0000000140000000-0x0000000140232000-memory.dmp
memory/3904-0-0x0000000000810000-0x0000000000817000-memory.dmp
memory/4408-93-0x00000280567B0000-0x00000280567B7000-memory.dmp
memory/4832-82-0x0000000140000000-0x0000000140233000-memory.dmp
memory/4832-76-0x0000000140000000-0x0000000140233000-memory.dmp
memory/4832-77-0x00000253A2F40000-0x00000253A2F47000-memory.dmp