Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
20/03/2024, 21:12
General
- Target d9d608ab32980f9e48afb47cf5caa989.dll
- Size 2.1MB
- Sample240320-z2askacb9t
- SHA256 283dc15f926b6bf944fc28d8354f13f6ef85090dfae357a33dcb04658f96ce1a
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d9d608ab32980f9e48afb47cf5caa989.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\Dtj4G\mstsc.exeC:\Users\Admin\AppData\Local\Dtj4G\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Luyu4i\sppsvc.exeC:\Users\Admin\AppData\Local\Luyu4i\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\O3GMq\LicensingUI.exeC:\Users\Admin\AppData\Local\O3GMq\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WINMM.dll
mstsc.exe
XmlLite.dll
sppsvc.exe
DUI70.dll
LicensingUI.exe
Mjigr.lnk
memory/60-97-0x00000225C2B60000-0x00000225C2B67000-memory.dmp
memory/3096-0-0x000002E35A580000-0x000002E35A587000-memory.dmp
memory/3096-1-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3096-8-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-32-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-37-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-12-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-13-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-15-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-16-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-14-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-17-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-18-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-19-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-20-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-21-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-22-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-24-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-25-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-26-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-27-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-28-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-23-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-30-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-31-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-7-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-29-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-33-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-34-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-35-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-36-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-11-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-38-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-39-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-40-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-41-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-42-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-43-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-44-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-46-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-45-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-47-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-48-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-49-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-50-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-51-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-53-0x00000000027B0000-0x00000000027B7000-memory.dmp
memory/3476-59-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-69-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-63-0x00007FFA8D860000-0x00007FFA8D870000-memory.dmp
memory/3476-71-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-10-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-9-0x0000000140000000-0x0000000140213000-memory.dmp
memory/3476-4-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/3476-5-0x00007FFA8C31A000-0x00007FFA8C31B000-memory.dmp
memory/4316-116-0x0000023A83740000-0x0000023A83747000-memory.dmp
memory/5060-80-0x000001C498420000-0x000001C498427000-memory.dmp
memory/5060-81-0x0000000140000000-0x0000000140215000-memory.dmp