Analysis Report Dridex-06-bc1b.xlsm

ID:	344478
Product:	CloudBasic
Start time:	16:27:54
Start date:	26.01.2021
Sample:	Dridex-06-bc1b.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	f72f88ebdf048fdfedf0aa3e298d9e71
SHA1:	b8ea58415338bed65d4cd194ead6ac663ad71a6c
SHA256:	78ccf25ecee02f759cefa6b1c29a00fb4ce64c000f7b9c04c1fc08e04d04bc1b
Filetype:	Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31B1227C.png	PNG image data, 650 x 85, 8-bit colormap, non-interlaced	DA5C67B7042BB04E6BFB9F60D9470287	BFBDC4596111EF5D95183DB0526353CBCA84C43F	0522D7C7600F1DD56346450DFE1466BA51CFEBCD095CD3154FB30DC563F96763
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\56C9D0A7.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	1C7221B8A7104792FDEEA41E5D7BA0D0	D49122E2BF94D92ED067570D638B672855C05893	76F287B1E3251B7E0E5BA27BFB05B35831150CC665DE00F9FD2D807E2D2A028D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77D8284D.png	PNG image data, 415 x 291, 8-bit colormap, non-interlaced	31F86AA3BD1ADA53D99B7BBEF6A1DEFC	148331C2D5EB437437D48ABE51866384D7154044	E0EC55345EDC7EF4BBE4F20ABD6F8FE965475C632766FAE6CA1853674F2DC34C
C:\Users\user\AppData\Local\Temp\986659.cvr	data	E55D9854B48468137B4BE7946D2E4D4D	E14FBF8F2D4D5523834FF3C99DE5690A7592B14C	DA8C4B2C1339F89EE846B16D3030B828705984F109F1F66E25B5CB673A822092
C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd	data	47FB0AEC60B0CC92888C17917249762D	6C086BD344A6CCBF212633358A5D3C6DFDB44A49	047A907BABD5E1BB1F963BE8364F765FBAF7D2E70649D0229536E009BB2A281E
C:\Users\user\Desktop\~$Dridex-06-bc1b.xlsm	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: Dridex-06-bc1b.xlsm

Avira: detected

Multi AV Scanner detection for submitted file

Source: Dridex-06-bc1b.xlsm	Virustotal: Detection: 50%			Perma Link
Source: Dridex-06-bc1b.xlsm	ReversingLabs: Detection: 58%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE

Jump to behavior

Networking:

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\56C9D0A7.emf

Jump to behavior

Found strings which match to known social media urls

Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Urls found in memory or binary data

Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: DWWIN.EXE, 00000003.00000002.3523274332.0000000003637000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: DWWIN.EXE, 00000003.00000002.3523274332.0000000003637000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: DWWIN.EXE, 00000003.00000002.3521034549.00000000023E0000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: DWWIN.EXE, 00000003.00000002.3523274332.0000000003637000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: DWWIN.EXE, 00000003.00000002.3523274332.0000000003637000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: DWWIN.EXE, 00000003.00000002.3523274332.0000000003637000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Dridex-06-bc1b.xlsm

OLE, VBA macro line: Private Sub pagoUno_Layout()

Document contains embedded VBA macros

Source: Dridex-06-bc1b.xlsm

OLE indicator, VBA macros: true

One or more processes crash

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1228

Binary contains paths to development resources

Source: DWWIN.EXE, 00000003.00000002.3522976184.0000000003450000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal64.expl.winXLSM@5/6@0/0

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Dridex-06-bc1b.xlsm

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\DWWIN.EXE

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1916

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRF66F.tmp

Jump to behavior

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\DWWIN.EXE

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: Dridex-06-bc1b.xlsm	Virustotal: Detection: 50%
Source: Dridex-06-bc1b.xlsm	ReversingLabs: Detection: 58%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1228
Source: unknown	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1228
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1228			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1228			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\DWWIN.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{713AACC8-3B71-435C-A3A1-BE4E53621AB1}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: Dridex-06-bc1b.xlsm	Initial sample: OLE zip file path = xl/media/image2.png
Source: Dridex-06-bc1b.xlsm	Initial sample: OLE zip file path = xl/media/image3.png
Source: Dridex-06-bc1b.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Document has a 'vbamacros' value indicative of goodware

Source: Dridex-06-bc1b.xlsm

Initial sample: OLE indicators vbamacros = False

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\System32\DWWIN.EXE

Window / User API: foregroundWindowGot 483

Jump to behavior

Queries a list of all running processes

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE

Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1228

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: DWWIN.EXE, 00000003.00000002.3520684964.0000000000770000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: DWWIN.EXE, 00000003.00000002.3520684964.0000000000770000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: DWWIN.EXE, 00000003.00000002.3520684964.0000000000770000.00000002.00000001.sdmp	Binary or memory string: !Progman