Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 16:57
General
- Target 4d78c3bc86ea9382e9afa9f9f1a3bca1338dc809a490fa8225f0b3c4dc79a0ba.dll
- Size 1020KB
- Sample240310-vgkd2sgh41
- SHA256 4d78c3bc86ea9382e9afa9f9f1a3bca1338dc809a490fa8225f0b3c4dc79a0ba
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4d78c3bc86ea9382e9afa9f9f1a3bca1338dc809a490fa8225f0b3c4dc79a0ba.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\cAb6ss\bdechangepin.exeC:\Users\Admin\AppData\Local\cAb6ss\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\a6ZUMiP2\raserver.exeC:\Users\Admin\AppData\Local\a6ZUMiP2\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\A8Xf\FXSCOVER.exeC:\Users\Admin\AppData\Local\A8Xf\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FXSCOVER.exe
MFC42u.dll
WTSAPI32.dll
raserver.exe
DUI70.dll
bdechangepin.exe
Zleyjbxoi.lnk
memory/1188-73-0x00007FF804140000-0x00007FF804240000-memory.dmp
memory/1188-68-0x000001E952DB0000-0x000001E952DB7000-memory.dmp
memory/1188-69-0x00007FF804140000-0x00007FF804240000-memory.dmp
memory/1860-84-0x00007FF8040D0000-0x00007FF8041D6000-memory.dmp
memory/1860-85-0x000001E519B80000-0x000001E519B87000-memory.dmp
memory/1860-89-0x00007FF8040D0000-0x00007FF8041D6000-memory.dmp
memory/2184-57-0x00007FF8040F0000-0x00007FF804235000-memory.dmp
memory/2184-53-0x0000025819760000-0x0000025819767000-memory.dmp
memory/2184-52-0x00007FF8040F0000-0x00007FF804235000-memory.dmp
memory/3164-13-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-17-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-20-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-23-0x00000000012E0000-0x00000000012E7000-memory.dmp
memory/3164-24-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-22-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-21-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-31-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-32-0x00007FF8218A0000-0x00007FF8218B0000-memory.dmp
memory/3164-33-0x00007FF821890000-0x00007FF8218A0000-memory.dmp
memory/3164-42-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-4-0x00007FF8208EA000-0x00007FF8208EB000-memory.dmp
memory/3164-18-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-19-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-16-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-15-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-14-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-3-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/3164-12-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-11-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-6-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-10-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-9-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-8-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3164-7-0x0000000140000000-0x00000001400FF000-memory.dmp
memory/3628-1-0x00007FF813360000-0x00007FF81345F000-memory.dmp
memory/3628-45-0x00007FF813360000-0x00007FF81345F000-memory.dmp
memory/3628-0-0x000001DC26A00000-0x000001DC26A07000-memory.dmp