Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/03/2024, 05:42
General
- Target c296671fb35928f936cf088a2574f6d3.dll
- Size 2.3MB
- Sample240312-gd43dsbf87
- SHA256 eef087012b24e72ae06d6a136ee17434720bc27610fe38f73c244fe2023e5ae7
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c296671fb35928f936cf088a2574f6d3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\jan\raserver.exeC:\Users\Admin\AppData\Local\jan\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\4s8h1\msdt.exeC:\Users\Admin\AppData\Local\4s8h1\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\zJpt3P3lG\usocoreworker.exeC:\Users\Admin\AppData\Local\zJpt3P3lG\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUser.dll
DUser.dll
msdt.exe
WTSAPI32.dll
raserver.exe
XmlLite.dll
usocoreworker.exe
DUser.dll
Zleyjbxoi.lnk
memory/1812-78-0x0000000140000000-0x0000000140244000-memory.dmp
memory/1812-73-0x0000020C0F0F0000-0x0000020C0F0F7000-memory.dmp
memory/1812-72-0x0000000140000000-0x0000000140244000-memory.dmp
memory/2468-0-0x0000000140000000-0x0000000140243000-memory.dmp
memory/2468-7-0x0000000140000000-0x0000000140243000-memory.dmp
memory/2468-1-0x000002A0D2260000-0x000002A0D2267000-memory.dmp
memory/2960-108-0x000001CE1F2B0000-0x000001CE1F2B7000-memory.dmp
memory/2972-91-0x0000000140000000-0x0000000140245000-memory.dmp
memory/2972-92-0x000002413FBF0000-0x000002413FBF7000-memory.dmp
memory/2972-97-0x0000000140000000-0x0000000140245000-memory.dmp
memory/3256-33-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-44-0x0000000000C50000-0x0000000000C57000-memory.dmp
memory/3256-24-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-25-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-26-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-27-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-28-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-29-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-30-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-31-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-32-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-22-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-34-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-35-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-36-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-37-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-39-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-38-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-41-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-42-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-40-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-23-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-43-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-51-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-55-0x00007FFD37960000-0x00007FFD37970000-memory.dmp
memory/3256-61-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-63-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-21-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-20-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-19-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-18-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-17-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-16-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-15-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-14-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-13-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-12-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-4-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/3256-8-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-11-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-10-0x0000000140000000-0x0000000140243000-memory.dmp
memory/3256-9-0x00007FFD35A2A000-0x00007FFD35A2B000-memory.dmp
memory/3256-6-0x0000000140000000-0x0000000140243000-memory.dmp