Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 22:01
General
- Target aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530.dll
- Size 796KB
- Sample240326-1w8cbage3s
- SHA256 aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\ZaDQKLuMF\WFS.exeC:\Users\Admin\AppData\Local\ZaDQKLuMF\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\v0ub\PresentationHost.exeC:\Users\Admin\AppData\Local\v0ub\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\79YQcXO4a\perfmon.exeC:\Users\Admin\AppData\Local\79YQcXO4a\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
credui.dll
perfmon.exe
WFS.exe
WINMM.dll
PresentationHost.exe
VERSION.dll
Mjigr.lnk
memory/876-74-0x00007FFAB7D90000-0x00007FFAB7E58000-memory.dmp
memory/876-73-0x00000245C96D0000-0x00000245C96D7000-memory.dmp
memory/876-78-0x00007FFAB7D90000-0x00007FFAB7E58000-memory.dmp
memory/2200-62-0x00007FFAB7E00000-0x00007FFAB7EC9000-memory.dmp
memory/2200-59-0x00000280FE460000-0x00000280FE467000-memory.dmp
memory/2200-57-0x00007FFAB7E00000-0x00007FFAB7EC9000-memory.dmp
memory/3476-12-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-38-0x00007FFAD5510000-0x00007FFAD5520000-memory.dmp
memory/3476-18-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-16-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-20-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-19-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-21-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-23-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-24-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-22-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-25-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-26-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-28-0x0000000002A30000-0x0000000002A37000-memory.dmp
memory/3476-27-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-29-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-37-0x00007FFAD5520000-0x00007FFAD5530000-memory.dmp
memory/3476-36-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-17-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-47-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-3-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/3476-15-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-6-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-14-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-13-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-11-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-10-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-7-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-8-0x00007FFAD40CA000-0x00007FFAD40CB000-memory.dmp
memory/3476-9-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3476-5-0x0000000140000000-0x00000001400C7000-memory.dmp
memory/3764-89-0x00007FFAB7E00000-0x00007FFAB7EC8000-memory.dmp
memory/3764-91-0x000001978C2E0000-0x000001978C2E7000-memory.dmp
memory/3764-94-0x00007FFAB7E00000-0x00007FFAB7EC8000-memory.dmp
memory/4808-0-0x00007FFAC7590000-0x00007FFAC7657000-memory.dmp
memory/4808-50-0x00007FFAC7590000-0x00007FFAC7657000-memory.dmp
memory/4808-2-0x000001FC196D0000-0x000001FC196D7000-memory.dmp