Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/03/2024, 15:50
General
- Target d3e69ce4903ad1257ab295ee57a98c36.dll
- Size 1.5MB
- Sample240318-s9554sch9v
- SHA256 09dc93203b0ce0f7d300615d91b1663549cbc7cfc39bc0b8667ceb4baaf445e2
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3e69ce4903ad1257ab295ee57a98c36.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\liCPAP\systemreset.exeC:\Users\Admin\AppData\Local\liCPAP\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\PS3\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\PS3\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\cFjiv5xKi\GamePanel.exeC:\Users\Admin\AppData\Local\cFjiv5xKi\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RdpSaUacHelper.exe
WINSTA.dll
GamePanel.exe
dxgi.dll
dxgi.dll
DUI70.dll
systemreset.exe
systemreset.exe
Zleyjbxoi.lnk
dxgi.dll
memory/412-9-0x0000000140000000-0x0000000140175000-memory.dmp
memory/412-3-0x00000188415F0000-0x00000188415F7000-memory.dmp
memory/412-0-0x0000000140000000-0x0000000140175000-memory.dmp
memory/412-1-0x0000000140000000-0x0000000140175000-memory.dmp
memory/936-89-0x0000000140000000-0x0000000140177000-memory.dmp
memory/936-85-0x000001F3D2EB0000-0x000001F3D2EB7000-memory.dmp
memory/936-82-0x0000000140000000-0x0000000140177000-memory.dmp
memory/936-83-0x0000000140000000-0x0000000140177000-memory.dmp
memory/1984-103-0x0000000140000000-0x0000000140176000-memory.dmp
memory/1984-104-0x0000020B9EBD0000-0x0000020B9ED46000-memory.dmp
memory/1984-106-0x0000020B9EC20000-0x0000020B9EC27000-memory.dmp
memory/1984-110-0x0000000140000000-0x0000000140176000-memory.dmp
memory/3388-18-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-16-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-27-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-28-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-29-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-31-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-32-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-33-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-34-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-30-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-36-0x0000000000A00000-0x0000000000A07000-memory.dmp
memory/3388-35-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-43-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-44-0x00007FF9F0B00000-0x00007FF9F0B10000-memory.dmp
memory/3388-53-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-55-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-25-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-24-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-6-0x00007FF9EF18A000-0x00007FF9EF18B000-memory.dmp
memory/3388-5-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/3388-8-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-11-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-23-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-22-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-21-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-20-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-19-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-17-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-26-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-15-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-14-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-13-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-10-0x0000000140000000-0x0000000140175000-memory.dmp
memory/3388-12-0x0000000140000000-0x0000000140175000-memory.dmp
memory/4148-71-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/4148-66-0x000001E9B1C80000-0x000001E9B1C87000-memory.dmp
memory/4148-64-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/4148-65-0x0000000140000000-0x00000001401BB000-memory.dmp