Analysis
- max time kernel
150s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/03/2024, 21:35
General
- Target b9b70b4077ca44355b4850e19c6e17d6.dll
- Size 2.1MB
- Sample240307-1fvfhsfd8z
- SHA256 0a65e748685b606573e04e320955af33a9fc673b50c7dc4ca6a4d53d9235cfc1
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b70b4077ca44355b4850e19c6e17d6.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\jbqLNLH\raserver.exeC:\Users\Admin\AppData\Local\jbqLNLH\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\oAsOxo9K\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\oAsOxo9K\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\d8y4RFGX\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\d8y4RFGX\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DevicePairingWizard.exe
DevicePairingWizard.exe
MFC42u.dll
MFC42u.dll
WTSAPI32.dll
WTSAPI32.dll
raserver.exe
raserver.exe
RdpSaUacHelper.exe
WINSTA.dll
WINSTA.dll
Psfjn.lnk
WINSTA.dll
WTSAPI32.dll
MFC42u.dll
memory/412-79-0x0000000140000000-0x0000000140212000-memory.dmp
memory/412-81-0x000001DFF6E80000-0x000001DFF6E87000-memory.dmp
memory/2260-99-0x0000013A87730000-0x0000013A87737000-memory.dmp
memory/2396-7-0x0000000140000000-0x0000000140211000-memory.dmp
memory/2396-1-0x0000021EC9530000-0x0000021EC9537000-memory.dmp
memory/2396-0-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-29-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-59-0x00007FFD57660000-0x00007FFD57670000-memory.dmp
memory/3528-21-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-19-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-20-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-17-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-32-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-36-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-37-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-39-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-41-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-43-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-48-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-49-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-47-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-46-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-45-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-50-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-51-0x0000000000B20000-0x0000000000B27000-memory.dmp
memory/3528-44-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-42-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-40-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-38-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-58-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-35-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-22-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-34-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-33-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-70-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-68-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-24-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-26-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-28-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-27-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-25-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-30-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-31-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-23-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-18-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-16-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-15-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-14-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-13-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-4-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3528-12-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-10-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-11-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-8-0x0000000140000000-0x0000000140211000-memory.dmp
memory/3528-9-0x00007FFD55A9A000-0x00007FFD55A9B000-memory.dmp
memory/3528-6-0x0000000140000000-0x0000000140211000-memory.dmp
memory/4952-117-0x00000216A47F0000-0x00000216A47F7000-memory.dmp