Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 19:40
General
- Target c6b54765a12c79d222a5d5c656eacefe.dll
- Size 2.0MB
- Sample240313-ydvx6agb85
- SHA256 52297cb74673c21b83e529f98e84a74c424c515a7eaecccba8120fb63e675fd9
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6b54765a12c79d222a5d5c656eacefe.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\CAmnPD62\iexpress.exeC:\Users\Admin\AppData\Local\CAmnPD62\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\4lQhrddN9\osk.exeC:\Users\Admin\AppData\Local\4lQhrddN9\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\FovrQoo\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\FovrQoo\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WMsgAPI.dll
osk.exe
VERSION.dll
iexpress.exe
DUI70.dll
DmNotificationBroker.exe
Mjigr.lnk
memory/2304-96-0x000001C1CD7D0000-0x000001C1CD7D7000-memory.dmp
memory/2816-82-0x0000000140000000-0x0000000140200000-memory.dmp
memory/2816-76-0x0000000140000000-0x0000000140200000-memory.dmp
memory/2816-77-0x000001BAC7440000-0x000001BAC7447000-memory.dmp
memory/3240-111-0x000002456DBA0000-0x000002456DBA7000-memory.dmp
memory/3408-35-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-40-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-21-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-20-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-22-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-23-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-24-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-25-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-26-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-27-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-28-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-30-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-29-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-31-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-32-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-33-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-34-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-36-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-5-0x00007FFEEF6FA000-0x00007FFEEF6FB000-memory.dmp
memory/3408-38-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-37-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-39-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-41-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-42-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-43-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-18-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-45-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-46-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-44-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-47-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-48-0x0000000002970000-0x0000000002977000-memory.dmp
memory/3408-55-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-56-0x00007FFEF0420000-0x00007FFEF0430000-memory.dmp
memory/3408-65-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-67-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-19-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-14-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-15-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-16-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-17-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-13-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-12-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-11-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-10-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-9-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-7-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3408-4-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/3856-0-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/3856-1-0x000002A943DD0000-0x000002A943DD7000-memory.dmp
memory/3856-8-0x0000000140000000-0x00000001401FF000-memory.dmp