Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
05/02/2024, 19:52
General
- Target 92da8ef77f8da35f26ca3745c5751b6e.dll
- Size 2.9MB
- Sample240205-yldnvafce3
- SHA256 69dfa8005188d9abbbdd5fb36e4ca5824e0e09d3b66a6ea1591063b2a498e124
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92da8ef77f8da35f26ca3745c5751b6e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\ig0s7n\FXSCOVER.exeC:\Users\Admin\AppData\Local\ig0s7n\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\h77O6GsV\WFS.exeC:\Users\Admin\AppData\Local\h77O6GsV\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\cC2\msconfig.exeC:\Users\Admin\AppData\Local\cC2\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MFC42u.dll
MFC42u.dll
MFC42u.dll
Ercyejwqgvsruoy.lnk
msconfig.exe
WFS.exe
FXSCOVER.exe
memory/1420-44-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-48-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-15-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-16-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-17-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-18-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-19-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-20-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-22-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-21-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-23-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-24-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-25-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-26-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-27-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-28-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-29-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-30-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-32-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-31-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-33-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-34-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-35-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-36-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-37-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-38-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-39-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-40-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-41-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-43-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-42-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-4-0x00000000771B6000-0x00000000771B7000-memory.dmp
memory/1420-45-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-49-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-14-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-47-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-46-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-50-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-51-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-52-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-54-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-53-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-55-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-56-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-57-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-58-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-60-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-59-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-61-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-62-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-63-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-64-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-65-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-69-0x0000000002A70000-0x0000000002A77000-memory.dmp
memory/1420-77-0x00000000773C1000-0x00000000773C2000-memory.dmp
memory/1420-78-0x0000000077520000-0x0000000077522000-memory.dmp
memory/1420-13-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-12-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/1420-7-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-10-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-124-0x00000000771B6000-0x00000000771B7000-memory.dmp
memory/1420-11-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1420-9-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/1480-142-0x0000000000080000-0x0000000000087000-memory.dmp
memory/2100-8-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/2100-1-0x0000000140000000-0x00000001402E0000-memory.dmp
memory/2100-0-0x0000000000110000-0x0000000000117000-memory.dmp
memory/2880-105-0x00000000000F0000-0x00000000000F7000-memory.dmp