Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 01:48
General
- Target b376f6ebedae76e9f3fe7b9530e5f2d2.dll
- Size 2.0MB
- Sample240305-b73tjaba3v
- SHA256 9e45fa53e2039703368f038277d13b5ad20162ca010861b330cb3f53ce6916de
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b376f6ebedae76e9f3fe7b9530e5f2d2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\PjO\OptionalFeatures.exeC:\Users\Admin\AppData\Local\PjO\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\iJ8nVxy6f\omadmclient.exeC:\Users\Admin\AppData\Local\iJ8nVxy6f\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\fd7G\SysResetErr.exeC:\Users\Admin\AppData\Local\fd7G\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
OptionalFeatures.exe
appwiz.cpl
appwiz.cpl
DUI70.dll
DUI70.dll
SysResetErr.exe
XmlLite.dll
XmlLite.dll
XmlLite.dll
XmlLite.dll
omadmclient.exe
omadmclient.exe
Mjigr.lnk
XmlLite.dll
DUI70.dll
appwiz.cpl
memory/760-114-0x00000184E2BA0000-0x00000184E2BA7000-memory.dmp
memory/2840-77-0x000001E03FDD0000-0x000001E03FDD7000-memory.dmp
memory/2840-82-0x0000000140000000-0x0000000140202000-memory.dmp
memory/2840-76-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3460-23-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-32-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-26-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-25-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-24-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-22-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-19-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-15-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-31-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-35-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-37-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-44-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-46-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-45-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-43-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-48-0x00000000008E0000-0x00000000008E7000-memory.dmp
memory/3460-47-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-42-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-41-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-40-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-39-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-55-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-38-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-36-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-34-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-30-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-33-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-65-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-67-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-29-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-28-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-27-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-4-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3460-21-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-20-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-18-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-6-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-17-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-16-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-14-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-13-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-12-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-56-0x00007FFA62840000-0x00007FFA62850000-memory.dmp
memory/3460-11-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-9-0x00007FFA6134A000-0x00007FFA6134B000-memory.dmp
memory/3460-10-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3460-8-0x0000000140000000-0x0000000140201000-memory.dmp
memory/4176-97-0x00000219A88A0000-0x00000219A88A7000-memory.dmp
memory/4400-7-0x0000000140000000-0x0000000140201000-memory.dmp
memory/4400-0-0x000001E6C1E60000-0x000001E6C1E67000-memory.dmp
memory/4400-1-0x0000000140000000-0x0000000140201000-memory.dmp