Analysis
- max time kernel
106s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/03/2024, 13:59
General
- Target d64957522d7e06632560b9be27d9e105.dll
- Size 3.2MB
- Sample240319-rapteaed81
- SHA256 ba2aaa43b3d97c708bb16ad1b00e3395a70c6f601ac8add2c927436a0112b894
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d64957522d7e06632560b9be27d9e105.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\LFNcK\msconfig.exeC:\Users\Admin\AppData\Local\LFNcK\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\GkKCL\AgentService.exeC:\Users\Admin\AppData\Local\GkKCL\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\v7Ur\lpksetup.exeC:\Users\Admin\AppData\Local\v7Ur\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ACTIVEDS.dll
ACTIVEDS.dll
AgentService.exe
AgentService.exe
VERSION.dll
msconfig.exe
dpx.dll
lpksetup.exe
Axoeay.lnk
ACTIVEDS.dll
memory/3356-44-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-49-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-19-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-18-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-20-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-21-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-23-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-22-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-24-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-26-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-25-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-27-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-28-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-29-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-30-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-31-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-32-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-33-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-34-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-35-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-36-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-37-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-38-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-39-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-40-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-42-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-41-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-43-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-4-0x0000000001090000-0x0000000001091000-memory.dmp
memory/3356-45-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-46-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-48-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-47-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-16-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-50-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-51-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-52-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-53-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-54-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-55-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-56-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-57-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-58-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-59-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-60-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-61-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-62-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-63-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-64-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-65-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-71-0x0000000001060000-0x0000000001067000-memory.dmp
memory/3356-79-0x00007FF99AA80000-0x00007FF99AA90000-memory.dmp
memory/3356-15-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-14-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-6-0x00007FF999B7A000-0x00007FF999B7B000-memory.dmp
memory/3356-7-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-8-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-9-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-13-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-12-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-11-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3356-10-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3492-17-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3492-1-0x0000000140000000-0x000000014033E000-memory.dmp
memory/3492-0-0x000001D2BE650000-0x000001D2BE657000-memory.dmp
memory/3896-99-0x00000180B5D70000-0x00000180B5D77000-memory.dmp
memory/4424-116-0x00000248567A0000-0x00000248567A7000-memory.dmp
memory/4672-133-0x0000021022CE0000-0x0000021022CE7000-memory.dmp