Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 00:28
General
- Target b353c255cfa7e6d9cf35b66d831b2dfe.dll
- Size 3.1MB
- Sample240305-asp4fsha6x
- SHA256 794fc58e1282720310534f2a57acdc13719a78d1656600ea94d9038f8825123d
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b353c255cfa7e6d9cf35b66d831b2dfe.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\Mpjt\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\Mpjt\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\sxs9B8P\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\sxs9B8P\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\X3t\mblctr.exeC:\Users\Admin\AppData\Local\X3t\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ACTIVEDS.dll
ACTIVEDS.dll
ApplySettingsTemplateCatalog.exe
ApplySettingsTemplateCatalog.exe
WTSAPI32.dll
WTSAPI32.dll
mblctr.exe
mblctr.exe
ACTIVEDS.dll
ACTIVEDS.dll
ApplySettingsTemplateCatalog.exe
ACTIVEDS.dll
Jnsvybh.lnk
WTSAPI32.dll
ACTIVEDS.dll
memory/1180-130-0x00000143DF580000-0x00000143DF587000-memory.dmp
memory/1440-98-0x000001E1CF640000-0x000001E1CF647000-memory.dmp
memory/2028-6-0x0000000140000000-0x0000000140323000-memory.dmp
memory/2028-0-0x0000000140000000-0x0000000140323000-memory.dmp
memory/2028-1-0x0000018C4E590000-0x0000018C4E597000-memory.dmp
memory/3484-40-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-51-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-18-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-17-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-23-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-24-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-25-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-27-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-26-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-29-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-28-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-30-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-31-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-32-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-33-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-34-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-36-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-37-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-35-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-39-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-20-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-41-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-42-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-43-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-44-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-45-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-38-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-46-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-49-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-48-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-50-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-22-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-52-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-53-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-47-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-54-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-55-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-56-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-58-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-59-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-57-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-60-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-64-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-65-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-63-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-21-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-61-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-62-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-69-0x0000000000A70000-0x0000000000A77000-memory.dmp
memory/3484-76-0x00007FFAE2660000-0x00007FFAE2670000-memory.dmp
memory/3484-4-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/3484-19-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-16-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-14-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-15-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-12-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-10-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-13-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-11-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-9-0x00007FFAE1B8A000-0x00007FFAE1B8B000-memory.dmp
memory/3484-7-0x0000000140000000-0x0000000140323000-memory.dmp
memory/3484-8-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4332-113-0x00000299950A0000-0x00000299950A7000-memory.dmp