Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 11:19
General
- Target b493c4fc1ea811b1bc3a635f04a2da9d.dll
- Size 1.8MB
- Sample240305-ne55eade2z
- SHA256 645f1f047a25414cbef3d452e2cdfa093cb1b90c8d94dc899c30432c88593224
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b493c4fc1ea811b1bc3a635f04a2da9d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\aXj\wextract.exeC:\Users\Admin\AppData\Local\aXj\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\bzLSIqZA\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\bzLSIqZA\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FileHistory.exeC:\Windows\system32\FileHistory.exe1⤵
-
C:\Users\Admin\AppData\Local\CZluRE7qQ\FileHistory.exeC:\Users\Admin\AppData\Local\CZluRE7qQ\FileHistory.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FileHistory.exe
UxTheme.dll
VERSION.dll
wextract.exe
RdpSaUacHelper.exe
WINSTA.dll
Bgoltaavvu.lnk
WINSTA.dll
memory/2920-0-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/2920-2-0x000001D26EA50000-0x000001D26EA57000-memory.dmp
memory/2920-8-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-35-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-41-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-12-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-13-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-14-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-15-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-16-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-17-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-18-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-19-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-20-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-21-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-23-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-25-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-26-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-27-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-24-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-22-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-29-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-30-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-28-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-31-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-32-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-33-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-36-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-10-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-34-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-37-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-38-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-39-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-40-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-11-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-42-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-43-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-44-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-45-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-46-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-47-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-48-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-49-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-50-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-51-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-52-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-53-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-54-0x0000000000970000-0x0000000000977000-memory.dmp
memory/3452-61-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-62-0x00007FF9CECA0000-0x00007FF9CECB0000-memory.dmp
memory/3452-71-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-73-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-5-0x00007FF9CEC0A000-0x00007FF9CEC0B000-memory.dmp
memory/3452-4-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3452-7-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3452-9-0x0000000140000000-0x00000001401D3000-memory.dmp
memory/3528-121-0x0000025F6DF00000-0x0000025F6DF07000-memory.dmp
memory/3528-127-0x0000000140000000-0x00000001401D4000-memory.dmp
memory/3772-90-0x0000000140000000-0x00000001401D4000-memory.dmp
memory/3772-85-0x000002C0BA140000-0x000002C0BA147000-memory.dmp
memory/3772-83-0x0000000140000000-0x00000001401D4000-memory.dmp
memory/4948-105-0x000001BA5FEE0000-0x000001BA5FEE7000-memory.dmp
memory/4948-109-0x0000000140000000-0x00000001401D5000-memory.dmp
memory/4948-103-0x0000000140000000-0x00000001401D5000-memory.dmp