Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 15:57
General
- Target ca7f15694e11c312ddda3eb194d7ef09bb361c977c5db27cbda7201638dca614.dll
- Size 744KB
- Sample240310-td8rssfg37
- SHA256 ca7f15694e11c312ddda3eb194d7ef09bb361c977c5db27cbda7201638dca614
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca7f15694e11c312ddda3eb194d7ef09bb361c977c5db27cbda7201638dca614.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\O7TIjWS\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\O7TIjWS\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\UBZY\consent.exeC:\Users\Admin\AppData\Local\UBZY\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\Wm0opoXP\sdclt.exeC:\Users\Admin\AppData\Local\Wm0opoXP\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\ITieaCNl\dpapimig.exeC:\Users\Admin\AppData\Local\ITieaCNl\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
dpapimig.exe
DUI70.dll
SystemSettingsAdminFlows.exe
consent.exe
WTSAPI32.dll
sdclt.exe
sdclt.exe
Jnsvybh.lnk
memory/440-2-0x00000215D7850000-0x00000215D7857000-memory.dmp
memory/440-45-0x00007FFBFDC60000-0x00007FFBFDD1A000-memory.dmp
memory/440-0-0x00007FFBFDC60000-0x00007FFBFDD1A000-memory.dmp
memory/1652-76-0x00007FFBFD4A0000-0x00007FFBFD55B000-memory.dmp
memory/1652-78-0x000001EA2D250000-0x000001EA2D257000-memory.dmp
memory/1652-81-0x00007FFBFD4A0000-0x00007FFBFD55B000-memory.dmp
memory/2960-93-0x000001401A740000-0x000001401A747000-memory.dmp
memory/2960-97-0x00007FFBFD580000-0x00007FFBFD680000-memory.dmp
memory/2984-57-0x00007FFBFD580000-0x00007FFBFD680000-memory.dmp
memory/2984-52-0x0000023BAE070000-0x0000023BAE077000-memory.dmp
memory/2984-53-0x00007FFBFD580000-0x00007FFBFD680000-memory.dmp
memory/3388-14-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-16-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-24-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-31-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-33-0x00007FFC0CCF0000-0x00007FFC0CD00000-memory.dmp
memory/3388-32-0x00007FFC0CD00000-0x00007FFC0CD10000-memory.dmp
memory/3388-42-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-22-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-21-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-20-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-19-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-18-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-17-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-23-0x0000000000750000-0x0000000000757000-memory.dmp
memory/3388-8-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-15-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-13-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-11-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-12-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-10-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-9-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-6-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-7-0x0000000140000000-0x00000001400BA000-memory.dmp
memory/3388-3-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3388-4-0x00007FFC0C16A000-0x00007FFC0C16B000-memory.dmp