Managed XDR

c-users-user-desktop-invoice_21245.doc-copy (Dridex) — malware analysis report

File info

Filename
c-users-user-desktop-invoice_21245.doc-copy
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: azaz, Template: Normal.dotm, Last Saved By: User, Revision Number: 50, Name of Creating Application: Microsoft Office Word, Total Editing Time: 55:00, Create Time/Date: Thu May 19 02:25:00 2016, Last Saved Time/Date: Wed Nov 5 17:13:00 2025, Number of Pages: 1, Number of Words: 1, Number of Characters: 6, Security: 0
File size
367 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
1d20e9260c81a012747fae38ea249f4651f2b8a5
SHA256
08fcff9f8d738ad632922eef7ce92d5bcaf49e5803f0eed256e67947ac0146be
MD5
b2c0432d0e2b4f518d94f6613ce999f5

Malwares

  • Dridex

Signatures

Execution

T1203 office_exploit_creates_cmd: The document exhibits suspicious behaviour (creates a cmd.exe process)
T1203 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1064 office_macros_suspicious: Document contains suspicious macro
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1140 decompress_pefile: Unpacks a PE file into memory
T1027.002 decompress_pefile: Unpacks a PE file into memory
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1064 office_macros_suspicious: Document contains suspicious macro
T1140 unpacking_utilities: Uses Windows utilities to unpack data
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
T1552 cookie_files: Accesses cookie files

Discovery

T1518.001 antiav_detectreg: Attempts to detect installed antiviruses by a certain registry key
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1057 process_interest: Enumerates processes
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1083 checks_recent_files: Attempt to check recently opened files through registry

Command and Control

T1071.001 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1032 internet_security_options: Sets Internet connections options that are not secure
T1071 internet_security_options: Sets Internet connections options that are not secure
T1071.004 office_exploit_dns: The document exhibits suspicious behaviour (performs DNS requests)
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Exfiltration

T1022 encrypts_pc_info: Collects and encrypts information about the computer (possibly for exfiltration)

Other

executes_dropped_exe: Executes dropped exe files
dridex_apis: Dridex banking Trojan detected
yara_rules: Static rules
creates_in_windows: Creates files in the Windows directory
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
creates_suspended_process: Creates suspended process
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
open_winlogon_process: Trying to open winlogon process

Related reports

Managed XDR