Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
17/03/2024, 03:19
General
- Target cfca9b45cf0e417092b6a47f47263172.dll
- Size 1.4MB
- Sample240317-dvbkmadb94
- SHA256 7c9b232e2d52d79dd2c2f64d2196b1f356ec4d26e47202dc6cd41ed694f0a683
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfca9b45cf0e417092b6a47f47263172.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\sJmgI1po4\dwm.exeC:\Users\Admin\AppData\Local\sJmgI1po4\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\cRXGJIys\DWWIN.EXEC:\Users\Admin\AppData\Local\cRXGJIys\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\6ZRVD\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\6ZRVD\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
DUI70.dll
DmNotificationBroker.exe
DWWIN.EXE
VERSION.dll
VERSION.dll
dwm.exe
dxgi.dll
dxgi.dll
dxgi.dll
Qoupr.lnk
VERSION.dll
dxgi.dll
DUI70.dll
memory/1648-2-0x00000241FF480000-0x00000241FF487000-memory.dmp
memory/1648-0-0x0000000140000000-0x0000000140167000-memory.dmp
memory/1648-8-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3160-97-0x0000015632B30000-0x0000015632B37000-memory.dmp
memory/3160-100-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/3160-94-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/3504-23-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-9-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-27-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-31-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-32-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-30-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-29-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-28-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-26-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-25-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-34-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-41-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-33-0x0000000002B30000-0x0000000002B37000-memory.dmp
memory/3504-51-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-7-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-5-0x00007FFC8757A000-0x00007FFC8757B000-memory.dmp
memory/3504-4-0x0000000007450000-0x0000000007451000-memory.dmp
memory/3504-10-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-11-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-24-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-42-0x00007FFC876C0000-0x00007FFC876D0000-memory.dmp
memory/3504-13-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-14-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-15-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-22-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-17-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-18-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-19-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-20-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-21-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-16-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-12-0x0000000140000000-0x0000000140167000-memory.dmp
memory/3504-53-0x0000000140000000-0x0000000140167000-memory.dmp
memory/4508-65-0x000001CA12BE0000-0x000001CA12BE7000-memory.dmp
memory/4508-64-0x0000000140000000-0x0000000140168000-memory.dmp
memory/4508-68-0x0000000140000000-0x0000000140168000-memory.dmp
memory/4556-79-0x000001C7F1110000-0x000001C7F1117000-memory.dmp
memory/4556-83-0x0000000140000000-0x0000000140168000-memory.dmp