Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 22:01
General
- Target 8c1ba7ad8bea1a9208050b8f2b061cf1199505825b6bd775e83d5f513e22b5de.dll
- Size 792KB
- Sample240326-1xgwrade63
- SHA256 8c1ba7ad8bea1a9208050b8f2b061cf1199505825b6bd775e83d5f513e22b5de
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c1ba7ad8bea1a9208050b8f2b061cf1199505825b6bd775e83d5f513e22b5de.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\MYWzv\consent.exeC:\Users\Admin\AppData\Local\MYWzv\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\eLAQKy\Dxpserver.exeC:\Users\Admin\AppData\Local\eLAQKy\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\EUOVI\perfmon.exeC:\Users\Admin\AppData\Local\EUOVI\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\o66759\msra.exeC:\Users\Admin\AppData\Local\o66759\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
credui.dll
perfmon.exe
consent.exe
Dxpserver.exe
dwmapi.dll
NDFAPI.DLL
msra.exe
Axoeay.lnk
memory/2056-102-0x00007FFE93EC0000-0x00007FFE93F87000-memory.dmp
memory/2056-97-0x0000019E9EC80000-0x0000019E9EC87000-memory.dmp
memory/3376-26-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-38-0x00007FFEB2B50000-0x00007FFEB2B60000-memory.dmp
memory/3376-15-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-14-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-16-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-18-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-17-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-19-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-20-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-21-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-22-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-23-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-24-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-25-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-4-0x00007FFEB185A000-0x00007FFEB185B000-memory.dmp
memory/3376-27-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-29-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-28-0x0000000002D70000-0x0000000002D77000-memory.dmp
memory/3376-36-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-13-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-37-0x00007FFEB2B60000-0x00007FFEB2B70000-memory.dmp
memory/3376-47-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-3-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/3376-12-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-11-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-10-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-6-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-7-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-8-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-9-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4304-82-0x0000027C76A10000-0x0000027C76A17000-memory.dmp
memory/4304-86-0x00007FFE93EC0000-0x00007FFE93F87000-memory.dmp
memory/4512-70-0x00007FFE93EC0000-0x00007FFE93F87000-memory.dmp
memory/4512-66-0x0000027FD8C30000-0x0000027FD8C37000-memory.dmp
memory/4512-65-0x00007FFE93EC0000-0x00007FFE93F87000-memory.dmp
memory/4540-50-0x00007FFEA45B0000-0x00007FFEA4676000-memory.dmp
memory/4540-1-0x000001A581A40000-0x000001A581A47000-memory.dmp
memory/4540-0-0x00007FFEA45B0000-0x00007FFEA4676000-memory.dmp