Analysis
- max time kernel
149s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 04:34
General
- Target b13bb70505928f7652efe277d4566156.dll
- Size 1.5MB
- Sample240304-e7lrsshh4z
- SHA256 ff5080d1129f3e4048ce22d9d0ae2eba05033a9310430962d3b985f09115a85c
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Drops startup file 3 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b13bb70505928f7652efe277d4566156.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\78h\SndVol.exeC:\Users\Admin\AppData\Local\78h\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\Z9k85\isoburn.exeC:\Users\Admin\AppData\Local\Z9k85\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\Y30L\GamePanel.exeC:\Users\Admin\AppData\Local\Y30L\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SndVol.exe
dwmapi.dll
GamePanel.exe
dwmapi.dll
dwmapi.dll
UxTheme.dll
isoburn.exe
Bgoltaavvu.lnk
dwmapi.dll
memory/1120-79-0x0000020B368D0000-0x0000020B368D7000-memory.dmp
memory/1120-84-0x0000000140000000-0x0000000140186000-memory.dmp
memory/1120-77-0x0000000140000000-0x0000000140186000-memory.dmp
memory/1120-78-0x0000000140000000-0x0000000140186000-memory.dmp
memory/2064-114-0x0000000140000000-0x0000000140186000-memory.dmp
memory/2064-116-0x0000018506A90000-0x0000018506A97000-memory.dmp
memory/2064-122-0x0000000140000000-0x0000000140186000-memory.dmp
memory/3564-15-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-46-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-22-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-23-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-24-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-21-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-25-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-26-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-27-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-28-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-29-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-30-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-31-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-32-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-33-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-34-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-36-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-35-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-38-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-37-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-39-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-40-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-42-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-41-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-43-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-44-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-45-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-5-0x00007FFCE402A000-0x00007FFCE402B000-memory.dmp
memory/3564-47-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-48-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-50-0x0000000000680000-0x0000000000687000-memory.dmp
memory/3564-56-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-57-0x00007FFCE5EA0000-0x00007FFCE5EB0000-memory.dmp
memory/3564-66-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-68-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-20-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-19-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-18-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-17-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-16-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-13-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-14-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-4-0x0000000002230000-0x0000000002231000-memory.dmp
memory/3564-7-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-9-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-10-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-12-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3564-11-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3784-8-0x0000000140000000-0x0000000140185000-memory.dmp
memory/3784-2-0x0000026B29AB0000-0x0000026B29AB7000-memory.dmp
memory/3784-0-0x0000000140000000-0x0000000140185000-memory.dmp
memory/5056-103-0x0000000140000000-0x0000000140186000-memory.dmp
memory/5056-98-0x000001EBFC720000-0x000001EBFC727000-memory.dmp
memory/5056-95-0x0000000140000000-0x0000000140186000-memory.dmp