Resubmissions
23/03/2026, 02:00
260323-cffqcsds9n1005/03/2026, 16:32
260305-t1xm2scx3k1011/02/2026, 21:18
260211-z5q9qaav8h1011/05/2025, 03:54
250511-egp2javwat1003/09/2024, 14:02
240903-rb57sazdqf1003/09/2024, 13:51
240903-q59avszclf1002/09/2024, 19:51
240902-yk8gtsxbpd1002/09/2024, 02:27
240902-cxh7tazflg1002/09/2024, 02:26
240902-cwxc2sygll1021/06/2024, 19:37
240621-yca7cszgnd10Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/06/2024, 17:07
General
- Target Stealers/Dridex.dll
- Size 1.2MB
- Sample240609-vm7rjadd73
- SHA256 af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\iS9g\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\iS9g\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\jjojMc\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\jjojMc\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\cqAFtGf6\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\cqAFtGf6\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
DmNotificationBroker.exe
MoUsoCoreWorker.exe
XmlLite.dll
SYSDM.CPL
SystemPropertiesAdvanced.exe
Axoeay.lnk
memory/400-81-0x0000000140000000-0x0000000140189000-memory.dmp
memory/400-80-0x0000019F47670000-0x0000019F47677000-memory.dmp
memory/400-86-0x0000000140000000-0x0000000140189000-memory.dmp
memory/792-69-0x0000000140000000-0x0000000140144000-memory.dmp
memory/792-63-0x000001DD3C5A0000-0x000001DD3C5A7000-memory.dmp
memory/1436-0-0x000001AF6B1B0000-0x000001AF6B1B7000-memory.dmp
memory/1436-39-0x0000000140000000-0x0000000140143000-memory.dmp
memory/1436-1-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3000-52-0x0000000140000000-0x0000000140144000-memory.dmp
memory/3000-49-0x00000267D15D0000-0x00000267D15D7000-memory.dmp
memory/3000-46-0x0000000140000000-0x0000000140144000-memory.dmp
memory/3296-14-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-36-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-26-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-8-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-13-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-25-0x0000000001390000-0x0000000001397000-memory.dmp
memory/3296-9-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-10-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-11-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-12-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-29-0x00007FFEF6050000-0x00007FFEF6060000-memory.dmp
memory/3296-24-0x00007FFEF537A000-0x00007FFEF537B000-memory.dmp
memory/3296-15-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-7-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-6-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3296-4-0x0000000003310000-0x0000000003311000-memory.dmp