Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 03:01
General
- Target b5fa2e4139191f5c546343608e3cb1bf9192c332586454dce2bf443e9902935a.dll
- Size 792KB
- Sample240327-dh2w2sec4s
- SHA256 b5fa2e4139191f5c546343608e3cb1bf9192c332586454dce2bf443e9902935a
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5fa2e4139191f5c546343608e3cb1bf9192c332586454dce2bf443e9902935a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\ip7\OptionalFeatures.exeC:\Users\Admin\AppData\Local\ip7\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\38byHGLB\Magnify.exeC:\Users\Admin\AppData\Local\38byHGLB\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\8c4KWbVSo\bdeunlock.exeC:\Users\Admin\AppData\Local\8c4KWbVSo\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3964 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MAGNIFICATION.dll
Magnify.exe
DUI70.dll
bdeunlock.exe
OptionalFeatures.exe
appwiz.cpl
Axoeay.lnk
memory/2040-96-0x00007FFE932E0000-0x00007FFE933EC000-memory.dmp
memory/2040-90-0x0000013730270000-0x0000013730277000-memory.dmp
memory/2040-89-0x00007FFE932E0000-0x00007FFE933EC000-memory.dmp
memory/2372-1-0x00007FFEA45B0000-0x00007FFEA4676000-memory.dmp
memory/2372-0-0x000001E9DC500000-0x000001E9DC507000-memory.dmp
memory/2372-50-0x00007FFEA45B0000-0x00007FFEA4676000-memory.dmp
memory/3376-26-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-38-0x00007FFEB2B50000-0x00007FFEB2B60000-memory.dmp
memory/3376-15-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-18-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-19-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-20-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-21-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-22-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-23-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-24-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-25-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-16-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-28-0x0000000000D70000-0x0000000000D77000-memory.dmp
memory/3376-29-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-27-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-36-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-37-0x00007FFEB2B60000-0x00007FFEB2B70000-memory.dmp
memory/3376-17-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-47-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-13-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-14-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-5-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-3-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/3376-6-0x00007FFEB185A000-0x00007FFEB185B000-memory.dmp
memory/3376-7-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-12-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-11-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-8-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-9-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3376-10-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/3660-78-0x00007FFE933C0000-0x00007FFE93487000-memory.dmp
memory/3660-73-0x00000159F7510000-0x00000159F7517000-memory.dmp
memory/3660-74-0x00007FFE933C0000-0x00007FFE93487000-memory.dmp
memory/4280-62-0x00007FFE93420000-0x00007FFE934E7000-memory.dmp
memory/4280-57-0x00007FFE93420000-0x00007FFE934E7000-memory.dmp
memory/4280-58-0x0000022FBAC30000-0x0000022FBAC37000-memory.dmp