Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 13:00
General
- Target 8d170fb935c1136a1a3020c0bc06821be1f0d7802314bc244c73ccdfd19bcd38.dll
- Size 1020KB
- Sample240310-p82jradc91
- SHA256 8d170fb935c1136a1a3020c0bc06821be1f0d7802314bc244c73ccdfd19bcd38
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d170fb935c1136a1a3020c0bc06821be1f0d7802314bc244c73ccdfd19bcd38.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\tG1u\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\tG1u\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\crf6\isoburn.exeC:\Users\Admin\AppData\Local\crf6\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\JjI5vdj\DWWIN.EXEC:\Users\Admin\AppData\Local\JjI5vdj\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DWWIN.EXE
wer.dll
UxTheme.dll
UxTheme.dll
isoburn.exe
ACTIVEDS.dll
ApplySettingsTemplateCatalog.exe
Bgoltaavvu.lnk
memory/372-0-0x00007FFDC5210000-0x00007FFDC530F000-memory.dmp
memory/372-1-0x0000021C87BF0000-0x0000021C87BF7000-memory.dmp
memory/372-45-0x00007FFDC5210000-0x00007FFDC530F000-memory.dmp
memory/3508-14-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-13-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-17-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-11-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-18-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-16-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-19-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-20-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-21-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-22-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-24-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-23-0x0000000000880000-0x0000000000887000-memory.dmp
memory/3508-33-0x00007FFDD4970000-0x00007FFDD4980000-memory.dmp
memory/3508-32-0x00007FFDD4980000-0x00007FFDD4990000-memory.dmp
memory/3508-31-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-42-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-12-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-15-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-10-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-3-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3508-6-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-5-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-9-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3508-8-0x00007FFDD32FA000-0x00007FFDD32FB000-memory.dmp
memory/3508-7-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/4204-69-0x000001A5B2480000-0x000001A5B2487000-memory.dmp
memory/4204-68-0x00007FFDB5F60000-0x00007FFDB6060000-memory.dmp
memory/4204-73-0x00007FFDB5F60000-0x00007FFDB6060000-memory.dmp
memory/4576-57-0x00007FFDB6020000-0x00007FFDB6120000-memory.dmp
memory/4576-52-0x00007FFDB6020000-0x00007FFDB6120000-memory.dmp
memory/4576-53-0x0000025FFF850000-0x0000025FFF857000-memory.dmp
memory/4608-85-0x0000028AA1FA0000-0x0000028AA1FA7000-memory.dmp
memory/4608-84-0x00007FFDB5EB0000-0x00007FFDB5FB1000-memory.dmp
memory/4608-89-0x00007FFDB5EB0000-0x00007FFDB5FB1000-memory.dmp