Analysis
- max time kernel
149s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
24/02/2024, 19:21
General
- Target a28d9e1a8c1200adc65f17122ddd3fbc.dll
- Size 2.7MB
- Sample240224-x2s8sscb99
- SHA256 93005b50fdce53fe23163e600df3d604d6ce336603d858f05f757882d4271228
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a28d9e1a8c1200adc65f17122ddd3fbc.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\H15IRQ\msra.exeC:\Users\Admin\AppData\Local\H15IRQ\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\xqV\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\xqV\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\0qMi\mfpmp.exeC:\Users\Admin\AppData\Local\0qMi\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MFPlat.DLL
MFPlat.DLL
mfpmp.exe
UxTheme.dll
UxTheme.dll
msra.exe
MusNotifyIcon.exe
UxTheme.dll
UxTheme.dll
Tppniqudqfeoc.lnk
UxTheme.dll
UxTheme.dll
MFPlat.DLL
memory/2080-138-0x000001BE16B00000-0x000001BE16B07000-memory.dmp
memory/2080-135-0x0000000140000000-0x00000001402A9000-memory.dmp
memory/2080-143-0x0000000140000000-0x00000001402A9000-memory.dmp
memory/2508-8-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/2508-0-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/2508-2-0x00000000007A0000-0x00000000007A7000-memory.dmp
memory/3536-44-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-52-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-20-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-21-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-22-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-23-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-24-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-25-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-27-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-28-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-26-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-29-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-31-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-30-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-33-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-32-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-34-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-35-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-36-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-37-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-38-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-39-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-45-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-18-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-43-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-42-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-41-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-40-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-47-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-48-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-49-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-50-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-51-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-19-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-46-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-53-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-54-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-55-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-56-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-57-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-59-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-60-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-61-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-62-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-63-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-64-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-65-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-58-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-68-0x0000000000D20000-0x0000000000D27000-memory.dmp
memory/3536-75-0x00007FFFFD880000-0x00007FFFFD890000-memory.dmp
memory/3536-5-0x00007FFFFCE0A000-0x00007FFFFCE0B000-memory.dmp
memory/3536-4-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3536-17-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-16-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-9-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-10-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-11-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-15-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-13-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-14-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-7-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/3536-12-0x0000000140000000-0x00000001402A7000-memory.dmp
memory/4236-122-0x0000000140000000-0x00000001402A8000-memory.dmp
memory/4236-117-0x00000170D8110000-0x00000170D8117000-memory.dmp
memory/4236-115-0x0000000140000000-0x00000001402A8000-memory.dmp
memory/5024-103-0x0000000140000000-0x00000001402A8000-memory.dmp
memory/5024-98-0x000001C71E7C0000-0x000001C71E7C7000-memory.dmp
memory/5024-96-0x0000000140000000-0x00000001402A8000-memory.dmp