Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 10:34
General
- Target 24bf3109315adc55730d4a949ac4bc4851b7654c131ce402f86b273eb9456ebc.dll
- Size 736KB
- Sample240305-ml4dqacf91
- SHA256 24bf3109315adc55730d4a949ac4bc4851b7654c131ce402f86b273eb9456ebc
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24bf3109315adc55730d4a949ac4bc4851b7654c131ce402f86b273eb9456ebc.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\ywkcfi\omadmclient.exeC:\Users\Admin\AppData\Local\ywkcfi\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\bTTB8I1X\Magnify.exeC:\Users\Admin\AppData\Local\bTTB8I1X\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\LHpgwZEk\psr.exeC:\Users\Admin\AppData\Local\LHpgwZEk\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VERSION.dll
psr.exe
Magnify.exe
dwmapi.dll
XmlLite.dll
omadmclient.exe
Zleyjbxoi.lnk
XmlLite.dll
VERSION.dll
memory/8-72-0x00007FFE62110000-0x00007FFE621C9000-memory.dmp
memory/8-68-0x0000020FBBC20000-0x0000020FBBC27000-memory.dmp
memory/8-69-0x00007FFE62110000-0x00007FFE621C9000-memory.dmp
memory/636-0-0x000001351F700000-0x000001351F707000-memory.dmp
memory/636-43-0x00007FFE71260000-0x00007FFE71318000-memory.dmp
memory/636-1-0x00007FFE71260000-0x00007FFE71318000-memory.dmp
memory/1456-81-0x00007FFE70A30000-0x00007FFE70AE9000-memory.dmp
memory/1456-82-0x0000019955D80000-0x0000019955D87000-memory.dmp
memory/1456-86-0x00007FFE70A30000-0x00007FFE70AE9000-memory.dmp
memory/3300-12-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-15-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-22-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-29-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-30-0x00007FFE7F960000-0x00007FFE7F970000-memory.dmp
memory/3300-31-0x00007FFE7F950000-0x00007FFE7F960000-memory.dmp
memory/3300-40-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-20-0x0000000001060000-0x0000000001067000-memory.dmp
memory/3300-18-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-19-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-3-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/3300-6-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-8-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-21-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-14-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-17-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-16-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-13-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-11-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-5-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-7-0x00007FFE7ED0A000-0x00007FFE7ED0B000-memory.dmp
memory/3300-10-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/3300-9-0x0000000140000000-0x00000001400B8000-memory.dmp
memory/4232-55-0x00007FFE70A80000-0x00007FFE70B39000-memory.dmp
memory/4232-51-0x00000211D4D00000-0x00000211D4D07000-memory.dmp
memory/4232-50-0x00007FFE70A80000-0x00007FFE70B39000-memory.dmp