Analysis
- max time kernel
14s - max time network
16s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
14/02/2024, 11:35
General
- Target 9b8e75c00bba64509c46fd0604449cfd.dll
- Size 2.3MB
- Sample240214-np9kkshb5x
- SHA256 94f359f89174b60550de8c2f944e17ed7e95185a34e212b64068c3327dab2197
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Modifies registry class 3 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b8e75c00bba64509c46fd0604449cfd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ResetSubmit.inf1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ResetSubmit.inf1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\AppData\Local\uK82m\rstrui.exeC:\Users\Admin\AppData\Local\uK82m\rstrui.exe1⤵
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\ZRKjIGT0E\slui.exeC:\Users\Admin\AppData\Local\ZRKjIGT0E\slui.exe1⤵
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\wt2xe\p2phost.exeC:\Users\Admin\AppData\Local\wt2xe\p2phost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
slc.dll
SRCORE.dll
rstrui.exe
P2PCOLLAB.dll
slui.exe
SRCORE.dll
rstrui.exe
P2PCOLLAB.dll
p2phost.exe
memory/1140-37-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-40-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-19-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-20-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-21-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-22-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-9-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-23-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-24-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-25-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-26-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-10-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-27-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-28-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-29-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-30-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-31-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-32-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-33-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-35-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-36-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-4-0x0000000076B06000-0x0000000076B07000-memory.dmp
memory/1140-38-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-34-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-39-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-18-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-42-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-44-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-43-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-41-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-46-0x0000000002D80000-0x0000000002D87000-memory.dmp
memory/1140-52-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-53-0x0000000076D11000-0x0000000076D12000-memory.dmp
memory/1140-59-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-56-0x0000000076E70000-0x0000000076E72000-memory.dmp
memory/1140-63-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-69-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-17-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-16-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-15-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-5-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
memory/1140-7-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-14-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-13-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-12-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1140-11-0x0000000140000000-0x0000000140250000-memory.dmp
memory/1940-96-0x0000000000110000-0x0000000000117000-memory.dmp
memory/2964-78-0x0000000140000000-0x0000000140251000-memory.dmp
memory/2964-79-0x0000000000090000-0x0000000000097000-memory.dmp
memory/3068-0-0x0000000140000000-0x0000000140250000-memory.dmp
memory/3068-1-0x0000000000290000-0x0000000000297000-memory.dmp
memory/3068-8-0x0000000140000000-0x0000000140250000-memory.dmp