Analysis
- max time kernel
95s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 21:58
General
- Target aa428ec3bdbf6de2917f1292e4bdd1a9.dll
- Size 1.7MB
- Sample240227-1vjmkace48
- SHA256 c785a692f4504dbef9b3986de9a740fc2baf601d2ecf29cc689074f3cfd6cfd2
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa428ec3bdbf6de2917f1292e4bdd1a9.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\e6wn6H5\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\e6wn6H5\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\ve6eyD\tcmsetup.exeC:\Users\Admin\AppData\Local\ve6eyD\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\H3Mwngg\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\H3Mwngg\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MusNotifyIcon.exe
MusNotifyIcon.exe
UxTheme.dll
UxTheme.dll
InfDefaultInstall.exe
newdev.dll
newdev.dll
TAPI32.dll
TAPI32.dll
tcmsetup.exe
Axoeay.lnk
TAPI32.dll
UxTheme.dll
newdev.dll
memory/3296-16-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-11-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-19-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-20-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-21-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-22-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-23-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-24-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-25-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-26-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-27-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-28-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-29-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-30-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-31-0x0000000001390000-0x0000000001397000-memory.dmp
memory/3296-38-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-39-0x00007FFEF6060000-0x00007FFEF6070000-memory.dmp
memory/3296-48-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-50-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-17-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-4-0x0000000003310000-0x0000000003311000-memory.dmp
memory/3296-6-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-8-0x00007FFEF537A000-0x00007FFEF537B000-memory.dmp
memory/3296-9-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-15-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-10-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-14-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-13-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-12-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3296-18-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/3640-93-0x00000235AF560000-0x00000235AF567000-memory.dmp
memory/3640-99-0x0000000140000000-0x00000001401B0000-memory.dmp
memory/4580-76-0x000001E1E2320000-0x000001E1E2327000-memory.dmp
memory/4580-82-0x0000000140000000-0x00000001401B1000-memory.dmp
memory/4580-77-0x0000000140000000-0x00000001401B1000-memory.dmp
memory/4700-7-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/4700-0-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/4700-2-0x0000000001460000-0x0000000001467000-memory.dmp
memory/4860-65-0x0000000140000000-0x00000001401B0000-memory.dmp
memory/4860-59-0x0000028FFE270000-0x0000028FFE277000-memory.dmp
memory/4860-60-0x0000000140000000-0x00000001401B0000-memory.dmp