Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 21:57
General
- Target d1f0a15dbdc600dfe398482971d77b95be4b899b3bc3c1b1220356125568c322.dll
- Size 752KB
- Sample240310-1t86tsce76
- SHA256 d1f0a15dbdc600dfe398482971d77b95be4b899b3bc3c1b1220356125568c322
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f0a15dbdc600dfe398482971d77b95be4b899b3bc3c1b1220356125568c322.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\Ru9zYeP0\Magnify.exeC:\Users\Admin\AppData\Local\Ru9zYeP0\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵
-
C:\Users\Admin\AppData\Local\jQUyca9\phoneactivate.exeC:\Users\Admin\AppData\Local\jQUyca9\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\w6c4r\msconfig.exeC:\Users\Admin\AppData\Local\w6c4r\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Magnify.exe
OLEACC.dll
DUI70.dll
phoneactivate.exe
VERSION.dll
msconfig.exe
Xkmqd.lnk
memory/1156-57-0x00007FFA63D90000-0x00007FFA63E4D000-memory.dmp
memory/1156-53-0x0000025145AA0000-0x0000025145AA7000-memory.dmp
memory/1156-54-0x00007FFA63D90000-0x00007FFA63E4D000-memory.dmp
memory/2636-46-0x00007FFA72840000-0x00007FFA728FC000-memory.dmp
memory/2636-0-0x000002C0EA590000-0x000002C0EA597000-memory.dmp
memory/2636-1-0x00007FFA72840000-0x00007FFA728FC000-memory.dmp
memory/3500-14-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-16-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-17-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-18-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-20-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-19-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-21-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-22-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-24-0x0000000000880000-0x0000000000887000-memory.dmp
memory/3500-25-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-23-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-32-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-33-0x00007FFA818A0000-0x00007FFA818B0000-memory.dmp
memory/3500-34-0x00007FFA81890000-0x00007FFA818A0000-memory.dmp
memory/3500-43-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-10-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-15-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-13-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-12-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-11-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-9-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-6-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-8-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3500-4-0x00007FFA7FE0A000-0x00007FFA7FE0B000-memory.dmp
memory/3500-3-0x0000000002570000-0x0000000002571000-memory.dmp
memory/3500-7-0x0000000140000000-0x00000001400BC000-memory.dmp
memory/3860-82-0x00000232A0650000-0x00000232A0657000-memory.dmp
memory/3860-83-0x00007FFA64170000-0x00007FFA6422D000-memory.dmp
memory/3860-87-0x00007FFA64170000-0x00007FFA6422D000-memory.dmp
memory/4460-71-0x00007FFA64120000-0x00007FFA64222000-memory.dmp
memory/4460-66-0x00007FFA64120000-0x00007FFA64222000-memory.dmp
memory/4460-67-0x000001C8DE0D0000-0x000001C8DE0D7000-memory.dmp