Analysis
- max time kernel
152s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 22:01
General
- Target 94a0e31b7fa6134cad423b4d54ec7155cede213335d6561104dbed4b508a4522.dll
- Size 780KB
- Sample240310-1xasfacf54
- SHA256 94a0e31b7fa6134cad423b4d54ec7155cede213335d6561104dbed4b508a4522
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\94a0e31b7fa6134cad423b4d54ec7155cede213335d6561104dbed4b508a4522.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\UEm7\BitLockerWizard.exeC:\Users\Admin\AppData\Local\UEm7\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\6K424oG\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\6K424oG\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\A91wq\wermgr.exeC:\Users\Admin\AppData\Local\A91wq\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\WW1pzgSS9\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\WW1pzgSS9\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SYSDM.CPL
SystemPropertiesHardware.exe
wermgr.exe
BitLockerWizard.exe
FVEWIZ.dll
SYSDM.CPL
SystemPropertiesComputerName.exe
Qielivq.lnk
memory/1640-100-0x00007FFD7F3D0000-0x00007FFD7F494000-memory.dmp
memory/1640-95-0x000002471E810000-0x000002471E817000-memory.dmp
memory/3376-76-0x00007FFD7F3D0000-0x00007FFD7F494000-memory.dmp
memory/3376-72-0x0000021A64BD0000-0x0000021A64BD7000-memory.dmp
memory/3448-25-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-11-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-16-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-18-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-17-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-19-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-20-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-21-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-22-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-23-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-3-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3448-24-0x00000000007D0000-0x00000000007D7000-memory.dmp
memory/3448-26-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-33-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-34-0x00007FFD9D980000-0x00007FFD9D990000-memory.dmp
memory/3448-35-0x00007FFD9D970000-0x00007FFD9D980000-memory.dmp
memory/3448-44-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-5-0x00007FFD9CD1A000-0x00007FFD9CD1B000-memory.dmp
memory/3448-14-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-13-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-6-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-7-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-8-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-9-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-12-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-15-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3448-10-0x0000000140000000-0x00000001400C3000-memory.dmp
memory/3676-47-0x00007FFD8F700000-0x00007FFD8F7C3000-memory.dmp
memory/3676-0-0x0000015CA5810000-0x0000015CA5817000-memory.dmp
memory/3676-1-0x00007FFD8F700000-0x00007FFD8F7C3000-memory.dmp
memory/3680-60-0x00007FFD7F3D0000-0x00007FFD7F494000-memory.dmp
memory/3680-56-0x00007FFD7F3D0000-0x00007FFD7F494000-memory.dmp
memory/3680-55-0x0000027E18E80000-0x0000027E18E87000-memory.dmp