Analysis
- max time kernel
150s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
05/02/2024, 02:51
General
- Target 90d9438b34b8e0f5a7ff78f0a33057ff.dll
- Size 668KB
- Sample240205-dcbgxaagam
- SHA256 3cfc6b00299603753ebe179424e34883d0dde9e9e10397655386c423ca12527c
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90d9438b34b8e0f5a7ff78f0a33057ff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\fiR2mec\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\fiR2mec\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\TtHiXRN\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\TtHiXRN\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\69ojXS\sigverif.exeC:\Users\Admin\AppData\Local\69ojXS\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VERSION.dll
sigverif.exe
RdpSaUacHelper.exe
WINSTA.dll
DUI70.dll
DmNotificationBroker.exe
Aqwbkkvq.lnk
memory/1612-38-0x00007FF94C530000-0x00007FF94C5D7000-memory.dmp
memory/1612-0-0x00007FF94C530000-0x00007FF94C5D7000-memory.dmp
memory/1612-2-0x000001E74AD20000-0x000001E74AD27000-memory.dmp
memory/1820-50-0x00007FF93C770000-0x00007FF93C85D000-memory.dmp
memory/1820-45-0x00007FF93C770000-0x00007FF93C85D000-memory.dmp
memory/1820-46-0x00000293D1D00000-0x00000293D1D07000-memory.dmp
memory/1928-61-0x00007FF94B9A0000-0x00007FF94BA49000-memory.dmp
memory/1928-66-0x00007FF94B9A0000-0x00007FF94BA49000-memory.dmp
memory/1928-62-0x00000262E1280000-0x00000262E1287000-memory.dmp
memory/3528-9-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-10-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-35-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-24-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-25-0x00007FF95A700000-0x00007FF95A710000-memory.dmp
memory/3528-13-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-14-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-17-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-15-0x00000000011F0000-0x00000000011F7000-memory.dmp
memory/3528-16-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-12-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-26-0x00007FF95A6F0000-0x00007FF95A700000-memory.dmp
memory/3528-11-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-7-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-8-0x00007FF95885A000-0x00007FF95885B000-memory.dmp
memory/3528-5-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-6-0x0000000140000000-0x00000001400A7000-memory.dmp
memory/3528-3-0x0000000001240000-0x0000000001241000-memory.dmp
memory/4588-78-0x0000025A6DAE0000-0x0000025A6DAE7000-memory.dmp
memory/4588-82-0x00007FF94B9A0000-0x00007FF94BA48000-memory.dmp
memory/4588-77-0x00007FF94B9A0000-0x00007FF94BA48000-memory.dmp